Harden
Find the exposure. Fix what matters first.
Harden is Aegentra’s technical security practice. We assess Microsoft 365, test systems for exploitable weaknesses, strengthen email authentication and protect sensitive data, then rank every finding by risk so your team knows what to fix first. Consultants based in Europe work remotely and on site in Germany.
Services
Four ways Harden reduces exposure
Microsoft 365 security assessment
A configuration and evidence review of the agreed Microsoft 365 tenant. We examine how sign-ins are protected, who holds privileged roles, how email and collaboration are configured and which devices are managed, then explain which improvements your existing licences support.
- Identity, multi-factor authentication and administrator roles
- Email protection and external forwarding
- Sharing and guest access in SharePoint, OneDrive and Teams
- Device management and ownership of alerts
- A prioritised findings register and remediation plan
Penetration testing
Authorised testing of agreed web applications, APIs and external or internal networks, using tools and manual techniques to validate weaknesses within the permitted scope. Testing starts only after written authorisation, and urgent findings are escalated during the test rather than held for the report.
- Web applications and APIs, including user roles and separation between customers
- External networks and internet-facing services
- Internal networks from an agreed starting point
- A report that explains business impact and remediation
- A retest of the original findings, where agreed
Email security: SPF, DKIM and DMARC
Make your domain harder to impersonate. We inventory the services that send email on your behalf, review SPF, DKIM and DMARC together and move DMARC towards enforcement using evidence from legitimate mail flows, rather than publishing a restrictive policy blind.
- Inventory of domains and authorised senders
- SPF, DKIM and DMARC configuration and reporting
- Anti-phishing, link and attachment protection available under your licences
- Review of mailbox forwarding and permissions
- Documented exceptions and escalation steps
Data protection
Reduce inappropriate exposure of information in Microsoft 365. We review who can access important files and how people share them, design a classification people understand, and scope sensitivity labels and data loss prevention around the data and workflows that matter.
- Sharing and access review for agreed sites and workloads
- A classification scheme matched to your information
- Sensitivity labels and data loss prevention policies, piloted before rollout
- Preparation for Microsoft 365 Copilot, which works within existing permissions
Findings ranked by risk
Every finding has a rating and a next step
Each finding is rated by the likelihood of exploitation and the impact on the information and services involved, then ordered so the most serious exposure is addressed first. Ratings explain the decision; they are not a score to chase.
- Critical
- Exposure that could be exploited now with serious impact. Escalated immediately through the agreed route.
- High
- A significant weakness to treat as a priority.
- Medium
- A weakness to schedule into planned work.
- Low
- A hardening improvement or good practice with limited direct impact.
How it runs
From scoping call to verified changes
Scoping call
We confirm the systems, tenants or applications in scope, your concerns, access arrangements and any third-party permissions, then quote a fixed fee.
Assess or test
We review configuration or test the agreed targets within the written authorisation and the agreed limits.
Rank and explain
Findings are rated by risk and explained in terms of the information and services affected.
Agree the changes
You decide which remediation to approve, defer or assign to your IT provider. Implementation is scoped separately.
Verify
Where agreed, we retest or check implemented changes and record what is resolved and what remains open.
Boundaries
What Harden does not claim
An assessment or test covers an agreed scope at a point in time. It does not prove that a system is secure, does not make an organisation compliant with any framework and is not a 24/7 monitoring or incident response service unless that is separately agreed.
Some buyers require testers with particular qualifications or an accredited testing provider. Check the exact requirement before commissioning a test; your proposal names who will perform the work.
Technical work can contribute evidence to an ISO/IEC 27001 ISMS or an ISO/IEC 42001 AI management system.
Not sure where to start?
Tell us what concerns you, roughly how many people use Microsoft 365 and whether an IT provider supports you.