From Very High Risk to Low: What Expert-Led Microsoft 365 Remediation Can Accomplish
What happens when an organization already has an experienced IT administrator, an established MSP, and Microsoft 365 security controls in place, but brings in a specialist to take a deeper look?
In one recent engagement, the answer was significant.
Redeemer Cyber assessed the Microsoft 365 environment of an organization with more than 160 Microsoft 365 users. The organization had a longtime internal IT administrator and an established MSP supporting its broader technology needs.
Redeemer Cyber was brought in through the MSP to provide specialized Microsoft 365 security expertise.
The assessment revealed something important:
Having good IT support doesn't necessarily mean every layer of Microsoft 365 security has been comprehensively hardened.
The Assessment Revealed Significant Security Gaps
Redeemer Cyber performed a comprehensive assessment against the CIS Microsoft 365 Foundations Benchmark and the Redeemer Cyber Foundations Benchmark, encompassing 161 security controls.
The initial results included:
73% of benchmark controls Not Implemented
75% of our Top 20 prioritized critical controls Not Implemented
33 Critical findings requiring immediate attention
An overall Very High residual-risk rating
At the beginning of remediation, just 28 of 161 controls, or approximately 17%, were considered complete.
The gaps weren't limited to obscure configuration settings, either.
They included important security capabilities such as MFA, phishing-resistant authentication, Privileged Identity Management, risk-based Conditional Access, device-based access controls, external sharing restrictions, outbound anti-spam protections, and DMARC.
The organization had already invested in Microsoft 365.
The challenge was making sure the security configuration underneath that investment was as strong as it could be.
An Assessment Should Lead to Action
Finding security gaps is useful.
Closing them is what reduces risk.
The assessment gave the organization and its MSP a prioritized roadmap rather than simply producing a list of failed configuration checks. It also revealed that licensing was limiting some of the security capabilities that could be implemented consistently.
Before remediation began, the organization worked with its MSP to improve and standardize its Microsoft 365 licensing.
That unlocked additional security capabilities, including greater use of Microsoft's automated identity and threat-protection functionality.
Then the real work began.
IT + MSP + Microsoft 365 Security Specialist
One of the most important parts of this engagement was the collaboration between three different areas of expertise.
The organization's internal IT administrator brought more than a decade of institutional knowledge.
The MSP continued supporting the broader technology environment and Microsoft relationship.
Redeemer Cyber brought specialized Microsoft 365 security assessment, architecture, and remediation expertise aligned with the CIS M365 benchmark.
That distinction matters.
Redeemer Cyber wasn't there to replace the organization's IT administrator or MSP.
We were there to add specialized depth.
Microsoft 365 contains hundreds of security settings spanning identity, email, collaboration, endpoint security, privileged access, data protection, and more. Bringing in a specialist allowed the organization to focus additional expertise on that specific security layer while its existing technology relationships remained intact.
Remediation Isn't About Flipping Every Switch
Security remediation in a production environment requires context.
Every organization has different:
Users
Applications
Licensing
Business processes
Technical dependencies
Risk tolerances
That's why we didn't simply turn on every available security setting.
Redeemer Cyber worked directly with the organization's IT administrator to evaluate the findings and determine how controls should be implemented safely.
Some lower-effort controls could be handled independently by the internal administrator. More complex controls requiring architecture decisions, testing, change management, or specialized expertise were addressed collaboratively.
More Than a Dozen Conditional Access Policies Without Disrupting Users
Conditional Access was one of the most significant areas of improvement.
More than a dozen policies were developed to strengthen authentication and access to Microsoft 365.
Conditional Access is powerful, but implementing it incorrectly can also disrupt legitimate users.
So we tested before enforcing.
The policies were carefully evaluated with the organization's IT administrator before being enabled in production.
The result?
More than a dozen Conditional Access policies were deployed without inadvertently blocking legitimate user access.
That's an important part of expert-led remediation.
The objective isn't simply to make an environment more secure.
It's to make it more secure without unnecessarily preventing the business from operating.
From 17% to 97% Remediation Completion
At the beginning of remediation, approximately 17% of the assessed controls were complete.
By project close, 97% of the assessment findings had been addressed.
There's an important distinction here.
A 97% remediation-completion rate doesn't mean we blindly implemented 97% of CIS recommendations.
A finding is considered addressed once an appropriate disposition has been reached. Depending on the organization's requirements, that can mean implementing the control or making a deliberate decision to accept, defer, or not implement it because of factors such as licensing, risk tolerance, operational requirements, or technical feasibility.
The goal isn't a perfect score.
The goal is reducing risk while supporting the business.
From Very High Risk to Low Risk
The improvement wasn't limited to a compliance percentage.
Before remediation, the organization's overall Microsoft 365 residual risk was rated:
Very High
Following remediation:
Low
That's the outcome that ultimately matters.
A security assessment identifies the problems.
Remediation turns those findings into actual security improvements.
But Microsoft 365 Security Doesn't Stand Still
There was still one problem.
We could secure the environment today, but Microsoft 365 will continue changing tomorrow.
Threats evolve. Microsoft releases new capabilities. The organization itself changes. And the CIS Microsoft 365 Foundations Benchmark continues to introduce new and updated recommendations twice a year.
So the relationship didn't end when remediation was completed.
Following the project, the organization entered into a three-year M365 Assurance engagement with Redeemer Cyber and the MSP.
Rather than waiting years before performing another major security project, we return regularly to evaluate new and updated controls, perform remediation, and periodically reassess the environment against the latest benchmark.
That creates a continuous lifecycle:
Assess. Remediate. Maintain.
The Bigger Lesson
This engagement demonstrates something we believe strongly at Redeemer Cyber:
An organization can have good IT people, a capable MSP, premium Microsoft licensing, and existing security controls and still benefit from specialized Microsoft 365 security expertise.
Those roles aren't mutually exclusive.
In this case, they complemented each other.
The internal IT administrator understood the organization.
The MSP supported the broader technology environment.
Redeemer Cyber provided specialized Microsoft 365 security depth.
Together, the organization moved from 17% remediation completion to 97%, reduced residual risk from Very High to Low, deployed more than a dozen Conditional Access policies without disrupting legitimate users, and established a three-year program to help maintain those improvements.
That's what Assess. Remediate. Maintain. looks like in practice.
See the Full Case Study
This article only scratches the surface of the engagement. Our complete anonymized case study includes additional details about the original findings, licensing changes, remediation methodology, Conditional Access deployment, and ongoing assurance
strategy.
If you're wondering what a deeper look at your own Microsoft 365 environment might uncover, contact Redeemer Cyber to discuss a Microsoft 365 Security Assessment or Remediation engagement.
Comments