Cyber security assessment

Harbour & Finch Accountants Ltd · scan #2 · collected 06 Nov 2026, 09:55 · prepared by Softilo Assure
Exposure score41.8 / 100High (lower is better)
Cyber Essentials25%Not ready: 7 requirements failing
ISO/IEC 27001:202219%4 of 26 controls met

Attack scenarios

ScenarioLikely to succeedImpactRating
Administrator compromise to full tenant takeover
An administrator's account is phished or password-sprayed. With admin rights the attacker can read every mailbox, delete backups and lock the business out of its own systems.
 57%10.0/10Critical
Phishing to account takeover and invoice fraud
A staff member enters their password on a fake Microsoft login page. The attacker signs in, hides an inbox rule, watches for invoices and asks customers to pay a new bank account.
 46%7.0/10High
MFA bypassed by session-token theft
A convincing sign-in link relays the user's password and MFA prompt through the attacker's proxy, or a device-code prompt hands over a token directly. The attacker replays the stolen session from their own machine, so MFA never stops them.
 48%7.0/10High
Personal or commercial data exposed
Files are shared by public link, with uncontrolled guests or from a lost unencrypted laptop. Under UK GDPR this may need reporting to the ICO within 72 hours.
 37%6.0/10Medium
Ransomware through a vulnerable or unprotected device
Malware arrives through an unpatched or unsupported laptop, or an attachment that anti-malware does not catch, and encrypts files across the shared drives.
 26%9.0/10Medium
Your domain used to defraud customers and suppliers
Criminals send email that appears to come from your own domain - fake invoices or payment-change requests - damaging both your customers and your reputation.
 10%5.0/10Low

MITRE ATT&CK techniques left open

TechniqueTacticsLeft open by
T1078.004 Valid Accounts: Cloud Accountsinitial-access, persistence, privilege-escalation, defense-evasion IDN-008, IDN-009, IDN-010, IDN-012, IDN-002, IDN-005
T1110.003 Brute Force: Password Sprayingcredential-access IDN-010, IDN-002
T1110.004 Brute Force: Credential Stuffingcredential-access IDN-010
T1111 Multi-Factor Authentication Interceptioncredential-access IDN-009
T1213.002 Data from Information Repositories: Sharepointcollection DAT-001
T1530 Data from Cloud Storagecollection DAT-001, IDN-006
T1539 Steal Web Session Cookiecredential-access IDN-012
T1550.004 Use Alternate Authentication Material: Web Session Cookiedefense-evasion, lateral-movement IDN-010, IDN-012
T1557 Adversary-in-the-Middlecredential-access, collection IDN-009
T1566.002 Phishing: Spearphishing Linkinitial-access IDN-008
T1567 Exfiltration Over Web Serviceexfiltration DAT-001
T1621 Multi-Factor Authentication Request Generationcredential-access IDN-009
T1068 Exploitation for Privilege Escalationprivilege-escalation DEV-003
T1203 Exploitation for Client Executionexecution DEV-003, DEV-001, DEV-004
T1204.002 User Execution: Malicious Fileexecution DEV-001
T1005 Data from Local Systemcollection DEV-002
T1199 Trusted Relationshipinitial-access IDN-006

Prioritised action plan

#ActionWhenEffortRisk removed
1 Every user has registered MFA methods (IDN-002)
  1. Entra admin centre > Protection > Authentication methods > User registration details: filter 'Multifactor authentication capable = No'.
  2. Contact each listed user and walk them through https://aka.ms/mysecurityinfo (Microsoft Authenticator preferred).
  3. Prioritise administrators - they should use phishing-resistant methods (passkeys / FIDO2).
  4. Enable the registration campaign (Authentication methods > Registration campaign) to nudge remaining users.
 Now2.0 h8.8 pts
2 No dormant accounts (no sign-in for 90 days) (IDN-005)
  1. Review the listed accounts with their line managers.
  2. Block sign-in immediately for anyone who has left; delete after your retention period (convert mailboxes to shared if needed).
  3. Add an account-removal step to your leavers process and schedule a quarterly access review.
 Now1.0 h3.5 pts
3 Risky sign-ins are challenged or blocked (IDN-010)
  1. Entra admin centre > Protection > Conditional Access > New policy from template > 'Require multifactor authentication for risky sign-ins'.
  2. Set sign-in risk to Medium and High; grant: require MFA (or block High). Exclude break-glass accounts.
  3. Add the 'Require password change for high-risk users' template so leaked credentials are rotated.
 Now2.0 h9.9 pts
4 Guest invitations restricted (IDN-006)
  1. Entra admin centre > External Identities > External collaboration settings.
  2. Set 'Guest invite settings' to 'Only users assigned to specific admin roles can invite guest users'.
  3. Restrict guest user access to 'limited access' or 'most restrictive'.
 Now0.5 h0.1 pts
5 Access requires a managed device (IDN-012)
  1. Make sure every staff device is enrolled in Intune and compliant (see DEV-001) before enforcing.
  2. Conditional Access > New policy from template > 'Require compliant or hybrid Azure AD joined device' for all users and all cloud apps.
  3. Set the grant to require the device control - not 'MFA or compliant device'. Run report-only for a week, then On.
 Next 30 days4.0 h11.5 pts
6 SharePoint / OneDrive does not allow 'Anyone' links (DAT-001)
  1. SharePoint admin centre > Policies > Sharing.
  2. Set the external sharing level to 'New and existing guests' (or lower).
  3. Set the default link type to 'Only people in your organisation'.
 Next 30 days1.0 h2.3 pts
7 Devices checked in within 14 days (DEV-004)
  1. Contact the owners of the listed devices; have them connect and sync.
  2. Retire devices that are no longer in use (Intune > Devices > Retire).
  3. Set a device clean-up rule (Intune > Devices > Device clean-up rules) for 90 days.
 Next 30 days1.0 h0.3 pts
8 Devices meet the compliance policy (DEV-001)
  1. Intune admin centre > Devices > Monitor > Noncompliant devices: review the reasons per device.
  2. Fix the root cause with the device owner, then trigger a sync.
  3. Add a Conditional Access policy requiring a compliant device for access to company data.
 Next 30 days3.0 h1.9 pts
9 Admin roles are not held by everyday (mail-enabled) accounts (IDN-008)
  1. Create a separate, unlicensed admin account for each administrator (e.g. adm-jane@...).
  2. Assign the admin role to the new account and remove it from the daily-use account.
  3. Require phishing-resistant MFA for admin roles via Conditional Access authentication strengths.
 Next 30 days2.0 h0.4 pts
10 All devices run a supported operating system (DEV-003)
  1. Upgrade listed devices to a supported release (Windows 11 24H2/25H2, a current macOS).
  2. Replace hardware that cannot be upgraded, or remove it from scope and segregate it.
  3. Use Intune Windows Update rings / feature update policies to keep releases current.
 Next 30 days4.0 h1.3 pts
11 Devices are encrypted (DEV-002)
  1. Intune admin centre > Endpoint security > Disk encryption: create a BitLocker (Windows) / FileVault (macOS) policy.
  2. Assign it to all devices and escrow recovery keys to Entra ID / Intune.
  3. Add 'Require encryption' to your compliance policies so drift is detected.
 Next 30 days2.0 h0.6 pts
12 Administrators must use phishing-resistant MFA (IDN-009)
  1. Give each administrator a passkey (Microsoft Authenticator or a FIDO2 security key) via https://aka.ms/mysecurityinfo.
  2. Entra admin centre > Protection > Conditional Access > New policy: include the directory roles your admins hold.
  3. Grant > Require authentication strength > 'Phishing-resistant MFA'. Exclude one break-glass account; report-only for a day, then On.
 Next 90 days3.0 h1.0 pts
13 Microsoft Secure Score above 70% (GOV-001)
  1. Defender portal > Exposure management > Secure Score > Recommended actions.
  2. Work through actions marked 'Low' user impact first.
 Next 90 days4.0 h0.2 pts

Findings

CheckResultDetail
IDN-001 MFA enforced for every userPassConditional Access policy 'Require MFA for all users' requires MFA for all users (1 break-glass exclusion(s)).
IDN-002 Every user has registered MFA methodsFail3 of 21 active users have no MFA method registered.
IDN-003 Global Administrator count is between 2 and 4Pass3 Global Administrators.
IDN-004 Legacy authentication is blockedPassA Conditional Access policy blocks legacy authentication for all users.
IDN-005 No dormant accounts (no sign-in for 90 days)Partial1 enabled account(s) have not signed in for 90+ days.
IDN-006 Guest invitations restrictedPartialEvery member can invite guests without approval.
IDN-007 Users cannot consent to third-party appsPassUser consent and app registration are restricted.
IDN-008 Admin roles are not held by everyday (mail-enabled) accountsFail3 admin role holder(s) also use the account for mail and daily work.
IDN-009 Administrators must use phishing-resistant MFAFailNo Conditional Access policy requires phishing-resistant MFA for administrators, so a fake sign-in page can relay their MFA.
IDN-010 Risky sign-ins are challenged or blockedFailNo Conditional Access policy challenges or blocks risky sign-ins, so password spraying and leaked credentials go unanswered.
IDN-011 Device code sign-in is blockedPassConditional Access policy 'Block device code flow' blocks device code sign-in.
IDN-012 Access requires a managed deviceFailNothing requires a managed device, so a stolen password or session token works from the attacker's own computer.
APP-001 No third-party app holds high-risk delegated permissions without reviewPassNone of 1 third-party app(s) hold high-risk delegated permissions.
DEV-001 Devices meet the compliance policyFail3 of 18 devices are non-compliant.
DEV-002 Devices are encryptedFail1 device(s) are not encrypted.
DEV-003 All devices run a supported operating systemFail5 device(s) run an operating system that no longer gets security updates.
DEV-004 Devices checked in within 14 daysFail1 device(s) have not checked in for over 14 days.
DEV-005 Compliance policy requires a firewallPassCompliance policies require the firewall on every desktop platform in use.
DEV-006 Compliance policy requires anti-malwarePass'Windows baseline' requires anti-malware on Windows devices.
DAT-001 SharePoint / OneDrive does not allow 'Anyone' linksFail'Anyone' links are allowed - files can be opened without signing in.
EML-001 SPF record published and enforcedPassharbourfinch.example: SPF enforced
EML-002 DMARC policy set to quarantine or rejectPassharbourfinch.example: DMARC p=quarantine
EML-003 DKIM signing enabledPassharbourfinch.example: DKIM selectors: selector1, selector2
MBX-001 No inbox rules forward mail outside the organisationPassNone of 2 inbox rule(s) forward mail outside the organisation.
MBX-002 No inbox rules hide or delete incoming mailPassNone of 2 inbox rule(s) look like an attempt to hide mail.
GOV-001 Microsoft Secure Score above 70%PartialSecure Score 59% (58/98).
INF-001 No private files served from public web applicationsN/ASelf-hosted infrastructure is not in scope.
INF-002 Internet-facing servers run vendor-supported softwareN/ASelf-hosted infrastructure is not in scope.
INF-003 Services run without administrator or root rightsN/ASelf-hosted infrastructure is not in scope.
INF-004 Application database accounts are least-privilegeN/ASelf-hosted infrastructure is not in scope.
INF-005 No default or shared database passwordsN/ASelf-hosted infrastructure is not in scope.
INF-006 Every server runs a reporting EDR agentN/ASelf-hosted infrastructure is not in scope.
INF-007 Web applications keep access logsN/ASelf-hosted infrastructure is not in scope.
INF-008 Internet-facing servers are segmented from internal systemsN/ASelf-hosted infrastructure is not in scope.

Cyber Essentials - control status

ControlRequirementStatusBasis
CE-FW-BOUNDARYBoundary firewall/router in place, default admin password changed, admin interface not exposed to the internetEvidence needed Attestation required
CE-FW-DEVICESoftware firewall enabled on every in-scope deviceMet DEV-005
CE-SC-DEFAULTUnnecessary accounts, software and insecure defaults removed or disabledNot met IDN-004, IDN-007, DEV-001, INF-001, INF-005
CE-SC-LOCKDevices require a PIN, password or biometric to unlock, with brute-force throttlingEvidence needed Attestation required
CE-SC-AUTORUNAuto-run disabled for untrusted contentEvidence needed Attestation required
CE-SUM-SUPPORTEDAll software is licensed and supported by the vendorNot met DEV-003, INF-002
CE-SUM-14DCritical and high-risk updates installed within 14 days of releaseNot met DEV-004
CE-UAC-ACCOUNTSAccounts are only created for authorised people, with access appropriate to their rolePartially met IDN-006, INF-004
CE-UAC-REVIEWAccounts are removed or disabled when no longer requiredPartially met IDN-005
CE-UAC-ADMINAdministrative accounts are separate and used only for administrative tasksNot met IDN-003, IDN-008, INF-003
CE-UAC-MFAMulti-factor authentication on all cloud services, for every userNot met IDN-001, IDN-002, IDN-004
CE-MP-AVAnti-malware (or application allow-listing) on every in-scope deviceMet DEV-006, INF-006

ISO/IEC 27001:2022 - control status

ControlRequirementStatusBasis
ISMS-4-10ISMS scope, risk assessment, risk treatment, internal audit and management review (clauses 4-10)Evidence needed Attestation required
ISMS-SOAStatement of ApplicabilityEvidence needed Attestation required
A.5.1Policies for information securityEvidence needed Attestation required
A.5.9Inventory of information and other associated assetsEvidence needed Attestation required
A.5.14Information transferNot met DAT-001, EML-001, EML-002, EML-003, MBX-001
A.5.15Access controlNot met IDN-003, IDN-006, DAT-001, INF-004
A.5.16Identity managementPartially met IDN-005, IDN-006
A.5.17Authentication informationNot met IDN-001, IDN-002, INF-005
A.5.18Access rightsPartially met IDN-005, INF-004
A.5.23Information security for use of cloud servicesMet IDN-007, APP-001
A.5.24Information security incident management planning and preparationEvidence needed Attestation required
A.5.30ICT readiness for business continuityEvidence needed Attestation required
A.5.34Privacy and protection of PIIEvidence needed Attestation required
A.6.3Information security awareness, education and trainingEvidence needed Attestation required
A.8.1User endpoint devicesNot met IDN-012, DEV-001, DEV-002, DEV-005
A.8.2Privileged access rightsNot met IDN-003, IDN-008, IDN-009, INF-003, INF-004
A.8.5Secure authenticationNot met IDN-001, IDN-002, IDN-004, IDN-009, IDN-010, IDN-011, IDN-012
A.8.7Protection against malwareMet DEV-006, INF-006
A.8.8Management of technical vulnerabilitiesNot met DEV-003, DEV-004, INF-002
A.8.9Configuration managementNot met IDN-004, IDN-007, DEV-001, GOV-001, INF-001, INF-003
A.8.12Data leakage preventionNot met APP-001, DAT-001, MBX-001, INF-001
A.8.13Information backupEvidence needed Attestation required
A.8.15LoggingEvidence needed Attestation required
A.8.20Networks securityMet DEV-005, INF-008
A.8.21Security of network servicesMet EML-001, EML-002, EML-003
A.8.24Use of cryptographyNot met DEV-002

This report is decision support for preparing for certification. It does not constitute certification; Cyber Essentials is awarded by an IASME-licensed certification body and ISO/IEC 27001 by an accredited certification body.