Microsoft 365 Security & Governance Specialist
What I can dofor you.
Microsoft 365 security and governance for small businesses — I find and fix the gaps in the tools you already pay for, in plain English.
Narrow on purpose.
I'm not a do-everything cybersecurity consultant. I help small businesses get the Microsoft 365 they already pay for set up safely — and write down how their IT actually works. Two clear packages, fixed prices, plain English.
Package 1
Microsoft 365 Security Health Check
Find the gaps in the Microsoft 365 you already pay for.
For: 5–50 staff who have Microsoft 365 but nobody managing it — construction, accounting, engineering, property management and small manufacturers.
Identity review
- MFA coverage
- Shared accounts
- Dormant users
- Admin accounts
- Guest accounts
Email security review
- SPF
- DKIM
- DMARC
- Anti-phishing
- Safe Links
- Safe Attachments (if licensed)
Microsoft Secure Score review
- Top 10 recommendations
- Quick wins
- Medium-effort fixes
Basic device security
- BitLocker
- Microsoft Defender
- Local admin usage
A plain-English 5–10 page report: executive summary, findings sorted into high / medium / low risk, recommended actions, and a 30-day roadmap.
What a finding looks like
Secure Score: 52 / 100
- High risk: No MFA on 5 accounts
- Medium risk: Guest accounts not reviewed
- Low risk: Secure Score recommendations outstanding
Quick wins: Enable MFA · Disable legacy authentication · Review external sharing
See what I look for.
This is the heart of the health check: enabling a handful of boring controls. Flip the switches and watch the risk drop.
Flip the switches. Watch your risk drop. (It never hits zero — nobody's bulletproof.)
Package 2
IT Documentation as a Service
Nobody wants to write it. Everybody needs it.
For: Small businesses that grew without ever writing down how their IT works — and now need it for insurance, clients or plain peace of mind.
Security policy pack
- Acceptable Use
- Password
- AI Acceptable Use
- Remote Work
- Incident Reporting
IT inventory
- Software
- Microsoft 365 licenses
- Vendors
- Critical systems
Access register
- System
- Owner
- Admins
- Business purpose
Backup register
- What gets backed up
- Frequency
- Retention
- Owner
Vendor register
- Microsoft
- QuickBooks
- Procore
- Dropbox, and the rest
Ongoing
Fractional Security Coordinator
The in-house security person you don't have — one hour a month.
$249–$499 / month
- Review Microsoft Secure Score
- Review users and dormant accounts
- Review MFA exceptions
- Quarterly policy update
- Monthly security-awareness email
- A 1-hour meeting each month
What I don't do.
Honesty up front — these need a bigger team or a dedicated provider, and I'll happily point you to one.
- 24/7 monitoring
- A security operations centre (SOC)
- Incident response
- Penetration testing
How it works.
- 1
Tell me what you need
Email a few lines about your business or website and what worries you.
- 2
I take a look
I review what's in scope and send a plain-English report with a prioritized fix list.
- 3
Fix it together
Fix it yourself with the report, or I can walk you through it step by step.
Want to see security ideas in action?
Two more little demos — just for fun. Poke at them; they explain the ideas better than I can.
SLO target: 99%
Servers break. Click a red one to heal it, or turn on auto-heal. The goal isn't zero failures — it's recovering fast enough to stay above target.
Your change is ready. Hit Run to ship it.
Project
This website.
Hardened by design.
Built as a static site with no server, database or login to attack, and served with a strict Content-Security-Policy, HSTS and anti-framing headers. Every change is checked automatically before it ships, and the live site is tested every hour. Don't take my word for it — check it yourself:
Latest writing.
10 security basics every small business should have
A plain-English checklist that stops most real-world attacks — no security team required.
October 4, 2026 · Substack ↗The Weekly TLDR: Anthropic's leaked IPO math — a $2 trillion ask and an $8 billion loss
Anthropic's numbers leak, Micron prints $54 billion, and the jobs market goes quiet.
July 4, 2026 · Substack ↗These free websites could help you become a cloud engineer
It provides tons of roadmaps for the hottest IT pathways right now.
Ready when you are.
Tell me briefly what you have and I'll reply within a couple of days.