Cyber Security Awareness Month 2026 · Assumed Breach, Actual Fix
Is Your M365 Tenant Actually Secure?
Most Australian and New Zealand organisations running M365 have never had their tenant security configuration reviewed. A fixed-scope review tells you exactly what's on, what's off, and what to fix - before Microsoft forces the issue for you.
Book Your M365 Security Review19%
of Australian businesses reported email compromise with no financial loss — the top self-reported cybercrime threat (ASD, 2024–25)
32%
of Australian organisations rank business email compromise as their single most troubling threat (Moxie Insights, 2025–26)
595
data breach notifications in just six months (Jul–Dec 2024) — the highest half-year total since reporting began (OAIC)
Identity and access, reviewed properly
Conditional Access policy coverage, MFA method policy including SMS/voice usage and passkey readiness, legacy authentication protocols, privileged and Global Admin role assignment, and guest and external user access.
Email security and data sharing, locked down
SPF, DKIM and DMARC configuration, Exchange Online mail flow and external forwarding rules, SharePoint and OneDrive external sharing defaults, and data loss prevention policy coverage.
Monitoring, licensing and governance, made visible
A Secure Score benchmark, audit logging and retention policy coverage, and a gap analysis between the security features you're already licensed for and what's actually configured.
Cyber Security Awareness Month 2026
Don't wait for Microsoft's deadline to find out what's misconfigured.
A fixed-scope review tells you exactly what's on, what's off, and what to fix before 1 February 2027, when SMS and voice MFA disappear entirely.
Book Your Review Talk to Our Partner TeamWhy organisations trust Insicon Cyber
ISO 27001 certified
Organisational-level certification, not just client-facing advice
Founder-led delivery
Matt Miller and Greg Bunt, Co-Founders and Fractional CISOs, stay close to client engagements
Trusted by ANZ organisations
Including Temple & Webster and James Milson Village
Award-winning
Retail Cyber Security Partner of the Year, 2025 Benchmark Security Awards
M365 Security Configuration Review pricing
50–100 seats
For organisations running a single M365 tenant with 50 to 100 seats.
AU$10,000 ex GST
What's included
- Identity and access review (Conditional Access, MFA, passkey readiness)
- Email security and data sharing audit
- Secure Score benchmark
- Prioritised findings report and fixed-scope remediation quote
100+ seats
For larger ANZ organisations and corporates running M365 at scale.
AU$15,000 ex GST
What's included
- Identity and access review (Conditional Access, MFA, passkey readiness)
- Email security and data sharing audit
- Secure Score benchmark
- Prioritised findings report and fixed-scope remediation quote
MSP and partner
Managing M365 security across multiple client tenants? Ask about the MDR Partner Programme.
Custom pricing
Built for MSPs
- Multi-tenant review pricing
- A wedge into a fuller MDR Partner Programme conversation
- Aware, Active and Adaptive partner tiers available
Book Your Review
Frequently asked questions
Why run this review now?
Microsoft is retiring SMS and voice MFA in favour of passkeys, with passkeys becoming the default authentication method from 1 September 2026 and full retirement from 1 February 2027. Most Australian and New Zealand organisations running M365 have never had their tenant configuration reviewed end to end, and this deadline is forcing the issue.
What does the review actually check?
Identity and access (Conditional Access, MFA method policy, legacy authentication, privileged roles, guest access), email security (SPF, DKIM, DMARC, mail flow rules), data sharing (SharePoint and OneDrive external sharing, DLP), device and app access, and monitoring, licensing and governance.
What do we receive at the end?
A findings report ranked by severity, a Secure Score benchmark, and a fixed-scope quote for remediation if you'd like us to action the findings.
Do we have to engage Insicon Cyber to fix what you find?
No. You can keep the report and action the findings yourselves, or engage Insicon Cyber as a professional services project. We set out a clear RASCI for both paths before you decide.
Do you work with organisations outside Australia?
Yes. We work with organisations across Australia and New Zealand.
Sources: ASD, Cyber Action Year 2026 · ASD, Annual Cyber Threat Report 2024-25 · OAIC, Notifiable Data Breaches Jul-Dec 2024 · Help Net Security, Entra ID authentication overhaul · Office 365 for IT Pros, MFA telephony retirement
- AI Security & Governance
- Cyber Readiness Assessment
- AI Readiness Assessment
- Cyber Advisory
- AI Security Governance Advisory
- Cyber Security Risk Assessment
- Tabletop and Cyber Simulation Exercises
- CISOaaS (CISO as a Service)
- Information Security Compliance (ISO 27001)
- AI Compliance (ISO 42001)
- Quality Assurance Compliance (ISO 9001)
- Essential Eight (E8)
Insicon Cyber acknowledge the Traditional Owners of Country throughout Australia and recognise the continuing connection to lands, waters and communities. We pay our respect to Aboriginal and Torres Strait Islander cultures; and to Elders past and present.