Security for your business · Hosted in the EU
Know what puts your business at risk. And what to fix first.
Connect Microsoft 365 for 82 security checks across your accounts, apps and devices. Get a clear report that names the risks, explains their impact and helps you take the next step.
No card required. Read-only assessment. Your complete report to keep.
Your Microsoft 365 assessment
82 checks · Clear priorities · Suggested fixes
Administrator accounts are also used for daily email
[email protected] · [email protected]
Suggested next step
Give each of these people an ordinary account for daily work and keep the admin account for admin only, with a hardware-backed passkey on it. About ten minutes per person.
- More Global Administrators than the business needs
- An application can read everyone's email
Sample names. Findings and suggested fixes come from the product’s check pack. Your results depend on your workspace.
Connect your workspace
Read-only Microsoft 365 access. No agent to install.
See your real risks
A report naming your accounts, apps and devices, usually within an hour.
Choose what happens next
Understand each fix, review what needs approval, and keep the audit trail.
Built to help a small team act with confidence. Human judgement still matters. Read our capabilities and limits.
- 82
- Microsoft 365 posture checks
- Deterministic checks in pack m365-2026.08.1, across privilege, authentication, access policy, hygiene, exposure, devices, applications, logging and licensing. Counted from the shipping check pack.
- < 1 hour
- Connection to a named posture report
- Discovery targets 30 minutes unattended; the platform measures time-to-assessment against a one-hour claim rather than assuming it.
- 80
- MITRE ATT&CK techniques covered
- 12 of 14 tactics. Reconnaissance and Resource Development are not covered because both happen outside the customer's estate and are not detectable from its telemetry. Measured 2026-08-31.
- 0
- Detection rules needing third-party attribution
- The detection library is entirely first-party authored, so no rule carries a licence obligation that would put another vendor's name in your alert interface.
- 9
- Changes we make without asking
- A closed allowlist: audit logging, log source connection, mailbox auditing, log retention, detection activation, shadow detection, asset tagging, sign-in risk telemetry and scheduling an access review. Every multi-factor and Conditional Access change is deliberately absent.
The claim, and its evidence
Better than nobody. Worse than a good analyst. Priced accordingly.
A small company cannot run enterprise-grade security without a specialised team. Our target is 60–75% of what a competent analyst would catch on known attack patterns — with a full audit trail, at a fraction of the cost — because the product does the setup and bounds its own autonomy.
Every vendor in this category publishes an impressive reduction percentage and no false positive rate. We would rather publish the band we actually sit in, next to the human number that beats it, because the console shows you our measured figures anyway — so marketing that inflated them would be contradicted by our own software inside a week.
The point is not that the software is as good as a person. It is that your realistic alternative is not a person.
Full kill-chain investigations completed correctly
- Frontier language models
- 61–67%
- Purpose-built security agent
- 72%
- Where we aim to sit — our target, not a measured result
- 60–75%
- Strong human analysts
- 73–85%
Task completion on 100 full kill-chain scenarios in the Simbian AI SOC benchmark. A frontier model today is a mediocre-to-decent junior analyst: clearly better than nobody, clearly worse than a good human.
Four products, one platform
The four things a security programme is made of
Identity, privileged access, log analysis and endpoint detection are normally four vendors, four consoles, four invoices and four sets of assumptions about who is watching. Here they share one policy graph, one audit chain and one price.
Identity and access
Every sign-in decided by a rule you can read, and a trace showing which one won.
What ships, and what does not
Privileged access
Administrators do the work without ever holding the password.
What ships, and what does not
Log collection and detection
Your logs in one place, matched against detections that carry their own false-positive guidance.
What ships, and what does not
Endpoint detection and response
What the suspicious process actually did, and a response you can take back.
What ships, and what does not
Bounded autonomy
Clear control over what happens next
You should know what will change before it affects your team. Qorionix separates limited automatic actions from changes that need your approval and decisions only your business can make.
Done — we already did it
Nine limited changes that do not interrupt work or grant access. Every one is reversible. You are told what happened and can undo it from the report.
- Switch on unified audit logging
- Connect the log source
- Set a one-year log retention baseline
- Activate a detection that needs no tuning
Approve — one tap, with the undo shown
Changes that could affect how people sign in or what they can access wait for your approval. You see the action, who it affects and how to reverse it before deciding.
- Require a second factor for administrators
- Revoke an application's consent
- Remove an external mail-forwarding rule
- Disable a dormant account
Decide — only you can
Some fixes involve business trade-offs. We explain the impact and identify the affected accounts or devices so that the person responsible can decide.
- Separate admin accounts from daily email
- Turn off a legacy sign-in protocol
- Restrict guest access
- Buy a higher Microsoft licence tier
What it will never do
Automated help has clear boundaries. Qorionix cannot grant privileged access on your behalf, and it keeps the decisions below with the people responsible for your business.
How the autonomy tiers work- A skilled attacker targeting you specifically
- Detection works on known patterns. A patient adversary who studies your business and uses no recognisable technique is outside what any product at this price detects. We escalate; we do not pretend.
- Anything your Microsoft licence does not emit
- Sign-in log analysis and Conditional Access evaluation need Entra ID P1. Where the data is unavailable the affected checks are reported as skipped, never as passed — a licence limitation must not become a false all-clear.
- The first fortnight of behavioural detection
- Learning what is normal for your business takes five to fourteen days of your real traffic. That is a property of the data, not the software, and nobody can compress it.
- Your business trade-offs
- Turning off a legacy sign-in protocol is a large security win that will break a printer and one laptop. We will tell you which ones by name. We will not decide for you.
- Deploying software to your endpoints
- The sensor has to be installed. If you cannot roll out software to your machines, the endpoint half of the platform cannot help you.
- Being a human on the phone at 3am
- Some vendors sell people; we sell software. If you want a specialist to call, that is a real thing to want, and we will tell you where to buy it rather than implying we are it.
- Granting privileged access
- Never automated, at any tier, at any confidence. The capability is not exposed to the model at all, so it cannot be talked into it.
- Rewriting its own rules
- The rung above acting — software that authors detections and adjusts its own limits — is not built. Rule-writing autonomy without versioning and rollback quietly degrades coverage, and you would find out from an intrusion.
Why this exists
Security decisions need clear evidence
Most security tools assume you already have a team to run them. A smaller business needs a clear place to start: what is connected, what is at risk and which action matters next.
35.5%
of EU enterprises have any document setting out their ICT security measures. Two thirds of the market does not have the artefact we produce in an hour.
Eurostat, ICT security in enterprises, 2024
29.3%
of small EU enterprises run an ICT risk assessment, against 75.6% of large ones. The gap is not appetite; it is that an assessment currently needs a consultant.
Eurostat, ICT security in enterprises, 2024
70%
of EU organisations name compliance as their primary security investment driver — ahead of any threat.
ENISA, NIS Investments 2025 (1,080 EU organisations)
76%
of EU organisations struggle to attract security staff and 71% to retain them. Hiring your way out of this is not available.
ENISA, NIS Investments 2025
45.2%
of EU enterprises keep log files for post-incident analysis. Fewer than half could reconstruct what happened.
Eurostat, ICT security in enterprises, 2024
€10m / 2%
NIS2 requires the maximum available fine for essential entities to be at least €10 million or 2% of worldwide annual turnover, whichever is higher. This is a threshold for the maximum, not a minimum penalty for each infringement.
Directive (EU) 2022/2555, Articles 20 and 34
NIS2 gives management a role in approving and overseeing cybersecurity measures. For essential entities, Article 34 requires the maximum available fine to reach at least €10 million or 2% of worldwide annual turnover, whichever is higher. These are thresholds for maximum fines, not minimum penalties for individual infringements.
What we actually produce for an auditQuestions
The ones worth asking a security vendor
Find out what an attacker would see
Connect Microsoft 365 and read your own posture report. 82 checks against your real tenant, naming your real administrators, applications and devices. Free, complete, and yours to keep — not a sample with the findings blurred.
No card. No sales call before you have read the report.