Threat Actor Perspective
A short, structured look at the environment the way an attacker would approach it. One or two working sessions with your architects, read-only access, and a focused review of where an intruder would go first. Nothing is attacked and nothing is disrupted. The result is a ranked set of attack paths, the reasoning behind each one, and a clear recommendation on what to fix, what to test, and what can wait.
€1 600–5 000 · 1–3 days · no testing
- Scoping callThirty minutes before the engagement begins: what you run, what concerns you, and what a useful outcome looks like. This sets the scope and the fixed fee.
- Architecture sessionTwo to four hours with the people who built and run the environment. Stack, data flows, trust boundaries, integrations and the parts nobody is comfortable with.
- Read-only reconnaissanceA reader account in the tenant and directory, plus whatever is visible from outside. The question throughout is what an attacker would see, not what a compliance checklist would ask for.
- Attack-path shortlistThe routes that actually matter, chained from a plausible starting point to something worth reaching, and ranked by how far each one gets and how much effort it takes.
- BriefingA live walkthrough with your team and a written briefing note, the findings, the reasoning, and a recommendation on what to fix directly, what warrants a penetration test, and what does not need attention yet.
- Written briefing note with ranked attack paths
- The reasoning behind each path, not just a list
- A recommendation on what to fix, test, or leave
- Live walkthrough with your team
- Fixed fee, agreed before the work starts
Questions people ask
Can three days really tell us anything?
It is deliberately scoped to answer one question well: where would an attacker go first, and is that acceptable. It is not a full audit and does not pretend to be. Most environments have two or three paths that carry the real risk, and those are usually visible from the architecture and a read-only account. What you get is a decision, not an inventory.
How much access do you need?
A read-only account in the tenant and directory, architecture and network documentation, and repository read access if application code is in scope. Nothing with write permissions, and no Global Administrator at any point.
How is this different from Secure Score?
Secure Score grades your configuration against Microsoft's defaults, one setting at a time. It will not tell you that a CI/CD service principal created three years ago can grant itself Global Administrator, because no individual setting is wrong, the chain is. Attack-path analysis looks for the chain.
What usually happens next?
Roughly speaking: some findings are straightforward enough to fix immediately, some areas warrant a penetration test to establish whether they are genuinely exploitable, and the rest is documented and left. The briefing says which is which. There is no obligation to buy either.