Cyber security
Our cyber security services protect the accounts, devices, email and data your organisation runs on, across Microsoft 365, Windows and Apple. We set up the protection already in your licences, close the gaps that attackers use first, and give you evidence your clients, insurers and auditors can check.
The security review
Trusted by teams across UK government, healthcare, education, charities, financial services and global brands
6
basic identity controls in Microsoft’s free security defaults
72 hours
to report a notifiable personal data breach to the ICO
14 days
to install critical and high-risk updates under Cyber Essentials
300 users
the upper limit for Microsoft Defender for Business
Sources: Microsoft Learn, security defaults, ICO, personal data breaches, NCSC Cyber Essentials requirements v3.3 and Microsoft Learn, Defender for Business.
Multi-factor sign-in, conditional access, encryption, email protection, patching and backups, set up and run for you.
Many attacks start in the same few places. None of them needs exotic tools to fix.
Scenario 1
Some accounts still sign in without multi-factor authentication, or older mail apps use legacy sign-in that skips it. Admin accounts are used for everyday email.
What you can doTurn on MFA for everyone, block legacy sign-in and give administrators separate, protected accounts. Conditional access then decides who gets in, from which device.
Scenario 2
Without SPF, DKIM and DMARC, anyone can send email that appears to come from your domain, including to your clients.
What you can doPublish SPF and DKIM, then move DMARC from monitoring to quarantine and reject, as the NCSC recommends. Protect domains that send no email too.
Scenario 3
A Mac bought by a team, or a personal PC used for work, reaches company data with no encryption, no updates and no protection.
What you can doEnrol Macs in Jamf and PCs in Intune, encrypt them, and only let compliant devices reach Microsoft 365.
Scenario 4
Files are shared with “anyone with the link”, and sensitive documents leave by email with nothing to stop them.
What you can doUse sensitivity labels and data loss prevention in Microsoft Purview, and set sensible external sharing rules in SharePoint and Teams.
Most attacks begin with a stolen or guessed password, so this is where we start.
Microsoft’s security defaults are free for every Microsoft 365 tenant. They ask everyone to register for MFA, require MFA for administrators, block legacy authentication and protect privileged actions. Microsoft describes them as a starting point: they are either on or off, with no exceptions or fine-tuning.
For a small organisation without premium licences, they are far better than nothing.
Conditional access needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium. It lets you set rules: MFA for every sign-in, access only from compliant devices, stronger checks for administrators and guests. Risk-based rules that react to suspicious sign-ins need Entra ID P2.
The two cannot run together, so moving from one to the other is planned, tested and rolled out in stages.
What changes when security is designed, enforced and reported on, rather than switched on and left.
| Area | Without | With Postremo IT |
|---|---|---|
| Sign-in | WithoutPasswords, with MFA for some people and not others. | With Postremo ITMFA for everyone, legacy sign-in blocked, separate admin accounts. |
| Devices | WithoutSome laptops encrypted and patched, nobody sure which. | With Postremo ITMacs in Jamf and PCs in Intune, encrypted, with recovery keys stored centrally. |
| Endpoint protection | WithoutA mix of antivirus products, or none on the Macs. | With Postremo ITMicrosoft Defender and Jamf Protect, set up from the licences you already pay for. |
| WithoutYour domain can be spoofed and nobody reads the reports. | With Postremo ITSPF, DKIM and DMARC in place and moved towards reject. | |
| Evidence | WithoutQuestionnaires answered from memory. | With Postremo ITReports from Intune, Jamf and Microsoft 365 that show what is in place. |
Security improves in stages, with evidence at every step.
Security review
We review identities, devices, email, data and backups against recognised baselines, and agree what matters most to your organisation.
Book a security reviewAgree the order
A clear list of risks and fixes, ordered by impact and effort, so the quick, high-value changes go first.
Without disruption
Changes are piloted with a small group, explained to your people and rolled out in stages, across Mac and Windows.
All year
Ongoing monitoring and reporting, with alerts investigated and acted on, and evidence ready for clients, insurers and auditors.
Most organisations we support run Macs alongside Windows, and we bring both to one standard. Windows PCs are managed in Microsoft Intune, with BitLocker switched on and recovery keys saved to Entra ID, and Microsoft Defender for Business providing antivirus and anti-malware protection, and endpoint detection and response. Defender for Business covers Macs, phones and tablets too.
Macs are managed in Jamf Pro, with FileVault enforced and recovery keys escrowed. Jamf Compliance Benchmarks apply CIS-aligned baselines, and Jamf describes Jamf Protect as Apple endpoint security with threat prevention and alerts for Macs that drift out of compliance. Jamf Pro shares each Mac’s compliance with Entra ID, so conditional access treats Macs and PCs the same way.
Protecting the information itself, and being able to recover when something gets through.
Business Premium includes sensitivity labels for email and files, data loss prevention and message encryption in Microsoft Purview. We set up a short, sensible set of labels your people will actually use, and rules that warn or block when sensitive data is about to leave.
For email, we publish SPF and DKIM, then take DMARC from monitoring to rejection in stages, following NCSC guidance, so mail from your domain is trusted and spoofed mail is refused.
The ICO says a notifiable personal data breach must be reported within 72 hours of becoming aware of it, and that you can report in stages while you find out more. Losing access to personal data, for example through ransomware, counts as a breach. An incident response plan written in advance makes those 72 hours manageable.
Central government and public sector bodies, healthcare, legal and financial services, and charities handling sensitive data, who must show their controls work.
Organisations that have outgrown a shared admin password and a single antivirus product, and now face security questionnaires from clients and insurers.
Teams that want specialist help with conditional access, Defender, Purview or Jamf Protect, alongside their own work. See co-managed IT.
We hold Cyber Essentials Plus ourselves, so we have been through the same questions and technical testing we prepare clients for. If you need certification, our Cyber Essentials service builds on the controls on this page.
For Cranbrook Legal, every Apple device is managed in Jamf Pro, people sign in through Jamf Connect, and Jamf Protect provides real-time macOS threat prevention for confidential client data.
Microsoft Defender and Jamf Protect come with your Microsoft and Jamf licences. We set them up and run them; we do not resell a separate security product.
Can’t see your question? Call us on +44 20 7550 9103 or book a call.
We protect identities, devices, email and data across Microsoft 365, Windows and Mac. That covers MFA and conditional access, Microsoft Defender and Jamf Protect, encryption, email authentication, sensitivity labels and data loss prevention, backups and incident response, with reporting you can share.
Yes. Macs are managed in Jamf Pro with FileVault, Compliance Benchmarks and Jamf Protect. Jamf Pro shares Mac compliance with Entra ID, so conditional access applies to Macs and PCs alike. Windows PCs are managed in Intune with BitLocker and Microsoft Defender.
Microsoft 365 Business Premium includes Entra ID P1 for conditional access, Intune, Defender for Business and Purview sensitivity labels and data loss prevention. Larger organisations may use E3 or E5. We review your current licences before recommending any change.
Security defaults are a sound free starting point: MFA for everyone and legacy sign-in blocked. They cannot be customised, though. If you have Business Premium or Entra ID P1, conditional access gives you finer control, such as allowing access only from compliant devices.
Yes. We put the controls and evidence in place and help with the technical questions from clients and insurers, using reports from Intune, Jamf and Microsoft 365.
Zero Trust means never assuming a user or device is safe because it is on your network. Every sign-in is verified, and only healthy, managed devices can reach company data.
Tell us how your people sign in, which devices they use and what your clients ask for. We will show you where the gaps are and what to fix first.
London head office
Postremo IT Limited
Level 24, One Canada Square
Canary Wharf
London E14 5AB
+44 20 7550 9103
info@postremoit.com
Also in Dubai
Business Bay, Dubai
Your brief: