Email and identity, closed in 30 days
The two doors attackers use most in Canadian mid-market firms are the mailbox and the login. This is a scoped project to close them, with a date and an evidence pack at the end.
Six things that are done when the month is over
Not a monitoring subscription. Not a portal login. Work with owners and dates.
Multi-factor authentication
Remote access, email and privileged accounts first, then the rest of the tenant. Conditional access so staff are not prompted to death.
SPF, DKIM and DMARC
Records set, reports watched, policy tightened. The cheap control that stops someone sending mail as you.
Forwarding and shared mailboxes
Hidden inbox rules, auto-forward to personal Gmail, and info@ accounts with a shared password. We find them and close them.
Finance callback rule
Written process: no new bank detail without a voice call on a number you already had. Dual control above a threshold you set.
One phishing simulation
A lure that looks like the mail your sector actually receives. Results as a trend, not a named-and-shamed list.
Evidence pack
Screenshots and a one-page summary your broker or a customer questionnaire can use this quarter.
Who this is for
- Canadian firms with roughly 15–200 people, usually on Microsoft 365.
- A renewal, a customer questionnaire, or a near-miss that made finance nervous.
- You want a finish date, not another managed-service conversation.
Who this is not for
- Consumer shops, sole props, or teams under 15 seats — the package does not pay for itself.
- An active breach. Call +1 866 848 7446 and ask for the on-call engineer.
What happens in each week
Week 1
Look, then lock the obvious
- Tenant and identity review
- MFA on remote access, email and admins
- Disable legacy protocols if they are still on
Week 2
Mail that cannot pretend to be you
- SPF / DKIM / DMARC
- External banners tuned so staff still notice them
- Forwarding and inbox-rule hunt
Week 3
The people who move money
- Callback rule with AP
- Shared mailbox cleanup
- VIP mailbox hardening
Week 4
Prove it
- Phishing simulation
- Readout with owners and dates
- Evidence pack for insurance or a customer
Book the 20-minute call
Tell us headcount, whether you are on Microsoft 365, and whether a broker or customer is waiting. We come back with a number, not a brochure.
Need the insurance form answered more broadly — backups, EDR, pentest dates? Use the cyber insurance evidence review.
Before you book
What does this cost?
Quoted after a 20-minute call. For a typical 25–80 user Microsoft 365 tenant in Canada, most engagements land in the mid four figures. Under 15 seats is usually too small for this package; over 200 users is a different scope.
Do we have to sign a 12-month contract?
No. This is a fixed 30-day project. If you want us to stay for helpdesk or monitoring after that, we quote it separately.
We are not on Microsoft 365. Can you still do this?
Yes, if you have Google Workspace or a mixed estate. The checklist changes; the outcome does not: MFA, mail authentication, forwarding lock-down, and a finance process.
Will this satisfy our cyber insurer?
It answers the questions they ask most often about email and identity. Backups, EDR and a pentest are separate — see the cyber insurance evidence review if that is the form in front of you.
Prefer to talk than type?
+1 866 848 7446 — ask for the email and identity offer. Toronto and Vancouver.