Every way in, drawn floor by floor.
Softilo Assure takes your Microsoft 365 apart like an architect's drawing, then shows which doors an attacker would walk through and which one to shut first.
Free for any domain. Ten seconds, no sign-up.
- checks in the demo, each one a building
- 19
- routes criminals use against UK firms
- 5
- of fixes took the demo from 79 to 35
- 8h
How to read the drawing
Every check is a building.
Each floor has its own form: houses for email, towers for identity, workstations for devices, a tank for data.
Height and colour are exposure.
Failing checks stand tall and orange. Partial ones get an orange roof. Passing ones sit low and pale.
A dashed line is an attack.
Each route has to pass every stage. Close one stage and the whole route fails, which is why the work is ordered by risk removed per hour.
One working day, 79 down to 35.
The demo survey of Harbour & Finch Accountants Ltd, a fictional 24-person practice. In the last year, 43% of UK businesses, and 46% of small businesses, identified a cyber breach or attack.1
| Door | Change | Hours | Exposure after |
|---|---|---|---|
| 1 | Admin roles are not held by everyday (mail-enabled) accounts | 2 | 61.6 |
| 2 | Users cannot consent to third-party apps | 1 | 53.0 |
| 3 | MFA enforced for every user | 3 | 41.1 |
| 4 | Every user has registered MFA methods | 2 | 34.6 |
Foundations your auditor can check without us.
Every verdict, the raw configuration behind it and every signed attestation go into a ledger where each entry is sealed with the hash of the one before.
Change any past entry and every seal after it breaks, and an independent timestamp authority signs the latest seal so the ledger can't be quietly rebuilt later. The export for your auditor includes the ledger, the timestamps and a checker that runs on any computer with Python, so nobody has to take Softilo's word for when a record was made.
| Entry | Verdict | Sealed with |
|---|---|---|
| 2 | IDN-001Partial | 5aed85dfdf |
| 3 | IDN-002Fail | d47bf31ddd |
| 4 | IDN-003Pass | 096f9db1c1 |
| 5 | IDN-004Fail | 7425316ba8 |
| 6 | IDN-005Partial | 44f836476e |
| 7 | IDN-006Partial | b40c7968f6 |
| 8 | IDN-007Fail | 238c5fa386 |
Start at the front door
Most routes in start with an email that looks like it came from you. Check whether your domain can be spoofed, then connect Microsoft 365 for the full survey.
1 Department for Science, Innovation and Technology, Cyber Security Breaches Survey 2025/26.