Approach
How an engagement runs, the three ways to work with us, and the fifteen conditions every environment we build meets.
How it works
Two weeks, read-only, against the fifteen conditions below. You keep the report either way.
We design and build the target state. Scoped and priced up front. No vague retainer, no drawn-out sales cycle.
Co-managed with your team or fully managed by ours. Senior engineers, no hand-offs, nobody relearning your environment.
Engagement models
Fixed fee, credited
Two weeks, read-only, fixed fee, credited in full against your first engagement. Your environment scored against the fifteen conditions below, every gap ranked with what it takes to close, a licensing and cost review, and a 90-day plan your team or ours can execute. Useful before a renewal, an acquisition, or a security review.
Monthly capacity
Fixed monthly capacity for design, build, and escalation, built to the baseline below, with your team trained to run it. Scope and hours defined up front.
Co-managed or fully managed
The retainer plus the operations and security stack, licensed through Corbel and deployed into your environment. Co-managed, where your team holds the day to day and we hold the standards and escalations. Or fully managed, where we hold all of it. Same standard either way.
Rates depend on scope. You'll hear the number on the first call.
The baseline
Fifteen conditions every environment we build meets. Most are settings your tenant already includes and nobody turned on. Count the ones you can say yes to.
MFA on every account. Phishing-resistant for admins.
No standing Global Admin. Privileged roles activated just in time, break-glass tested.
Conditional Access gates every sign-in on device compliance.
Every Windows device Autopilot-registered, Intune-managed, encrypted, keys escrowed.
Defender for Endpoint in block mode with attack surface reduction deployed. Not audit mode forever.
Quarantines are admin-release only. Users don't self-release what got them breached last time.
24x7 detection and response with a human on the other end. A compromised laptop at 2 a.m. is isolated before anyone reads the alert.
Access follows HR data through groups. Joiners get it on day one, leavers lose it in minutes, from every app.
Every app signs in through SSO. There is no spreadsheet of passwords anywhere.
No one has local admin on their own machine. IT included.
Every device has a lifecycle date. Refreshes are budgeted, not surprises.
SPF, DKIM, and DMARC enforced, not just published. Your domain can't be spoofed.
Sensitivity labels applied and external sharing controlled. You can say where sensitive data lives and who can send it out.
Licenses match job roles. Nobody pays for a full suite to use a mailbox.
Every setting above written down, with the reason, where your team will actually read it.
Before you call
Yes, when that's the right answer. We can run it fully managed, co-managed with your team, or sit above an incumbent that's working. If the MSP is the problem, we'll say so on the first call.
Roughly 100 to 2,000 seats. Below that you probably don't need us. Above that you have a department for this, and we're a second opinion or a specific build.
Almost never to start. Business Premium or E3 with Defender for Endpoint P2 covers the baseline for most companies. We'll tell you when E5 earns its price.
A named lead engineer and the Corbel team behind them, first call to handoff. Never subcontracted to a bench you haven't met.
A knowledge base your team reads, a written standard for every setting with the reason behind it, and a change log. If we disappeared tomorrow, the next person could keep running it.
Both. Microsoft licensing through Corbel as your CSP, hardware from the same place, margin disclosed. We'll also tell you when not to buy.
One call to find out if it's a fit. Both ways.