Overview
Over-privileged accounts and missing MFA show up in almost every UK incident we investigate. ISPM gives you a continuous view of identity hygiene across Microsoft 365, Active Directory and key SaaS platforms, and supports the user access control requirements of Cyber Essentials.
Every unused admin account, service account with a non-expiring password or user without MFA is a ready-made path for an attacker. In most organisations these issues accumulate silently across Active Directory, cloud identity providers and dozens of SaaS applications.
Managed ISPM gives you continuous visibility of identity posture and a team that drives remediation. We assess privileged access, authentication strength, dormant and orphaned accounts, dangerous delegations and identity-provider settings, prioritise by real attack paths, and work with your IT team to close them.
ISPM is the preventive half of identity security; Managed ITDR is the detective half. Together they cover identity risk end to end.
How our managed services work for UK organisations
- Cover through UK nights, weekends and bank holidays, when in-house teams are offline
- Escalations go to your named UK contacts by phone, email or Microsoft Teams, following agreed severities
- Monthly service reviews scheduled within UK business hours, with evidence packs for ISO 27001, Cyber Essentials and the NHS DSPT
- Data processing agreement covering transfers from the UK, using the IDTA or UK Addendum where personal data is involved
What's included
Our approach
- DiscoverInventory identities across directories, IdPs and key SaaS.
- AssessScore posture and map attack paths.
- PrioritiseRank by exploitability and blast radius.
- RemediateDrive fixes with your IT and identity teams.
- SustainContinuous checks and monthly posture reviews.
What you receive
- Identity posture score and baseline
- Privileged access findings
- Attack path analysis
- Remediation tracker
- Monthly ISPM report
Standards & frameworks
- NIST SP 800-63
- CIS Controls 5 & 6
- ISO/IEC 27001 A.5.15–5.18, A.8.2
- Zero Trust (NIST SP 800-207)
- Cyber Essentials
Frequently asked questions
What is ISPM?
Identity Security Posture Management continuously assesses and improves the security configuration of identities, privileges and identity systems.
How is ISPM different from IAM?
IAM manages who gets access. ISPM checks whether that access and the identity systems themselves are configured securely.
Will you change our accounts directly?
Remediation follows your change process; we can execute changes where you authorise us to.
Can you support UK organisations from India?
Yes. All services are delivered remotely by our team in India. India is 4.5 hours ahead of UK time during British Summer Time and 5.5 hours ahead in winter, so our working day overlaps with yours every morning and afternoon. Testing windows and escalation contacts are agreed around your UK schedule, and 24/7 services run around the clock.
Where is our data processed?
Engagement data is handled by our team in India under NDA, with encrypted storage, least-privilege access and secure deletion at the end of the agreed retention period. We can sign a data processing agreement using the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses where personal data is involved.