Global Admin without MFA
Three tenant Global Admin accounts found without MFA enforced. One had a password last rotated 2.5 years ago.
Fix: Enforce conditional access policy requiring MFA on all admin roles; rotate the stale password.
Sample patterns · not a client report
The shape of a finding, not a score.
These are invented patterns with no client names. Identity samples match the one-tenant Identity, Data & AI Security Review. Public-cloud samples illustrate the separately scoped cloud add-on. They are not a vulnerability count, and they are not evidence about any real firm.
Identity and access (sample)
The shape of a note from the one-tenant Microsoft 365 review. Read-only. These figures are examples.
Legacy auth still permitted
Basic authentication (POP/IMAP/SMTP) remained enabled tenant-wide. Six active sign-ins observed via legacy protocols in the last 30 days.
Fix: Block legacy auth via conditional access; migrate the 2 affected service accounts to modern auth.
Stale accounts retained access
Eleven user accounts had no sign-in in 180+ days but remained licensed and full members of high-trust groups.
Fix: Disable + audit; transfer mailboxes if needed; reclaim licenses (~$2,800/year saved here).
Small cloud footprint (sample add-on)
Not part of the base tenant review. A small cloud account in AWS, Azure, or GCP is a separately scoped add-on: read-only, and only with written authorization. The rows below are examples of that add-on, not of the Identity, Data & AI Security Review (from $3,500, typically $3,500–$5,500) and not of the M365 Quick Check ($750–$1,000).
Public S3 bucket with PII
One bucket had public-read ACL inherited from a 2022 prototype; contained 14 GB of customer-uploaded PDFs including SSNs and addresses.
Fix: Block-Public-Access at account level; remove bucket ACL; rotate any exposed credentials; review CloudTrail for prior access.
Default VPC widely used
Twelve EC2 instances ran in the default VPC with a security group permitting 0.0.0.0/0 on port 22. Three had RDP exposed too.
Fix: Migrate to least-privilege VPC; restrict SSH/RDP to a bastion or VPN CIDR; document approved access patterns.
Encryption-at-rest gaps
Eight EBS volumes were unencrypted; one RDS instance lacked storage encryption. KMS keys not consistently rotated.
Fix: Snapshot, re-encrypt, and replace volumes; enable RDS encryption migration; enforce default-encrypt at account level.
Cloud AI configuration (sample add-on)
Bedrock, Azure AI, and similar services sit in the cloud add-on when they live in AWS, Azure, or GCP. AI use inside Microsoft 365 is part of the tenant review. These rows are examples.
Bedrock + public S3 training data
Bedrock fine-tuning job referenced an S3 bucket marked public-read. Training data exposure risk needs to be investigated before further use.
Fix: Audit the bucket access log; remove public ACL; review whether to retrain on a hardened bucket; document AI data classification policy.
Azure AI Foundry over-shared
Foundry workspace had "anyone in the tenant" sharing enabled, including model deployment endpoints. Three workspaces affected.
Fix: Restrict workspace to Compute Contributor role; enable model endpoint authentication; review prompt logs for sensitive content.
OpenAI key in app config
Production app config table contained a long-lived OpenAI API key in plaintext, accessible to 7 deployment service accounts.
Fix: Rotate the key immediately; move to Azure Key Vault / AWS Secrets Manager; enforce key rotation policy; audit key usage logs.
Outside-in notes (sample)
Closer to the Free Exposure Snapshot ($0) than to the tenant review. That snapshot is a passive, public-records-only check of a firm’s domain and email setup. Public records are configuration facts. They are not evidence of compromise. See the labelled sample snapshot for the format and its limits.
DMARC not enforced
DMARC record set to p=none in this example. SPF and DKIM were aligned. A monitoring policy asks receivers to report, not to reject. That is a configuration fact, not evidence that mail was spoofed.
Fix: Monitor DMARC reports for 14 days; move to p=quarantine; then to p=reject after 60 days of clean reporting.
Expired TLS certificate
Subdomain staging.<customer>.com had a TLS certificate expired 4 months ago; modern browsers reject the connection.
Fix: Renew via ACM or Let's Encrypt; enable auto-renewal; add monitoring for cert expiration.
Shodan-visible RDP
Two IPs in the customer's allocated range showed Microsoft RDP on port 3389 indexed by Shodan; both lacked Network Level Authentication.
Fix: Restrict RDP to VPN-only access; enable NLA; move to Azure Bastion if no other RDP path needed.
A real review is scoped before it starts.
The base review starts at $3,500 for one Microsoft 365 tenant and a 30/60/90-day plan (typically $3,500–$5,500). The M365 Quick Check is $750–$1,000. Quarterly re-check retainers and add-on reviews for on-premises and Active Directory, and for small cloud accounts, are quoted separately. Add-ons are read-only, and only with written authorization.
Read the offer