Approach
How an engagement runs, the three ways to work with us, and the baseline every environment gets.
How it works
What's going on in your environment, and whether it's a fit. Both ways.
A defined plan and a start date. No vague retainer, no drawn-out sales cycle.
No hand-offs, no ramp-up, nobody relearning your environment.
Engagement models
Fixed scope
Two to three weeks, fixed fee. A findings report ranked by risk, a licensing and cost review, and a plan your team or ours can execute. Useful before a renewal, an acquisition, or a security review.
Monthly capacity
Fixed monthly capacity for design, build, and escalation, built to the baseline below, with your team trained to run it. Scope and hours defined up front.
Retainer plus tooling
The retainer plus the operations and security stack, licensed through Corbel and deployed into your environment. We hold the standards and escalations. Your team holds the day to day.
Rates depend on scope. You'll hear the number on the first call.
The baseline
Eight things every Corbel environment has. Most are settings your tenant already includes and nobody turned on.
MFA on every account. Phishing-resistant for admins.
No standing Global Admin. Privileged roles activated just in time, break-glass tested.
Conditional Access gates every sign-in on device compliance.
Every Windows device Autopilot-registered, Intune-managed, encrypted, keys escrowed.
Defender for Endpoint in block mode with attack surface reduction deployed. Not audit mode forever.
Quarantines are admin-release only. Users don't self-release what got them breached last time.
24x7 detection and response with a human on the other end, plus tenant backup.
Every setting above written down, with the reason, where your team will actually read it.
Before you call
Sometimes. More often we sit above one: we own the architecture, they work the tickets. If the MSP is the problem, we'll say so on the first call.
Roughly 100 to 2,000 seats. Below that you probably don't need us. Above that you have a department for this, and we're a second opinion or a specific build.
Almost never to start. Business Premium or E3 with Defender for Endpoint P2 covers the baseline for most companies. We'll tell you when E5 earns its price.
A named lead engineer and the Corbel team behind them, first call to handoff. Never subcontracted to a bench you haven't met.
A knowledge base your team reads, a written standard for every setting with the reason behind it, and a change log. If we disappeared tomorrow, the next person could keep running it.
Both, margin disclosed. We'll also tell you when not to buy.
One call to find out if it's a fit. Both ways.