What engagements look like in practice

• Professional services · Approx. 90 staff, three offices

  Untangling a Microsoft 365 tenant that grew without a plan

  Nobody could say with confidence who had access to client files, or how many people held administrative rights.

  What we found

  Fourteen accounts held Global Administrator rights, including two belonging to former employees and one shared account used by the IT provider.

  What we changed

  Reduced Global Administrator holders to two named accounts with just-in-time elevation, and moved the IT provider to a scoped delegated role.

  Outcome

  The firm can now answer client and insurer questions about access control with evidence rather than assumption.

  Microsoft 365 Security · Cyber Security Consultancy

  Read the full case study

• Distribution & logistics · Approx. 140 staff, one site plus depots

  Discovering that backups existed but recovery did not

  The board had been told the business was protected against ransomware. It had never been tested, and the assumption did not survive contact with a recovery exercise.

  What we found

  The nightly backup completed successfully, but covered the ERP database only — not the application server, its configuration or its integrations.

  What we changed

  Rebuilt the backup design around immutable, credential-isolated storage that production domain accounts cannot reach or delete.

  Outcome

  Recovery of the core system has been performed end to end and timed, so the figure the board relies on is measured rather than assumed.

  Business Continuity & Resilience · Cyber Security Consultancy

  Read the full case study

• Construction & property services · Approx. 220 staff

  Automating supplier invoice handling without opening a data route

  Invoice handling consumed most of a full-time role, and the finance team had begun pasting invoice PDFs into a free public AI tool to speed up data extraction.

  What we found

  Roughly a quarter of finance staff were using consumer AI tools for work, including with supplier documents containing bank details and commercially sensitive pricing.

  What we changed

  Established an approved AI position: a business-tier tool with data-retention controls, tenant-bound identity, and a short written policy staff could actually follow.

  Outcome

  The finance team reviews exceptions rather than keying every invoice, and the time released has gone into supplier query resolution and month-end.

  AI Automation & Agents · AI Security & Governance · AI Consultancy & Deployment

  Read the full case study

We do not publish client names, logos or testimonials without explicit written permission, and most clients in this field prefer not to give it. That is a deliberate trade: less social proof on the website, more candour in the case studies themselves.