Accounts and sign-in
MFA settings and coverage, account ownership and relevant access arrangements
Protect your business
Know what to improve before you spend on cybersecurity.
A Business Cyber Review gives you a structured starting point for protecting the work your business relies on. We review agreed evidence, explain the gaps and give you practical priorities across accounts, email, devices and recovery arrangements.
£395 for the standard small-business scope. VAT applies where applicable.
For small teams that need a clear view
This review is designed for an owner-led business using Microsoft 365, with a straightforward technology setup and no dedicated security team. It is useful when responsibilities have become unclear, staff or suppliers have changed, or you want an informed plan before committing to improvements.
If you already know you need Cyber Essentials certification, readiness support may be the more suitable starting point. The wider IT Health Review addresses the broader technology environment; this review focuses on security and resilience.
What the standard review covers
The fixed price covers one business, one Microsoft 365 tenant, up to 10 users and 10 devices, and one office network. We examine available management evidence and directly inspect up to three representative devices agreed in advance. We confirm suitability before booking; multiple tenants, servers, complex networks or specialist systems need a separate scope.
Permissions
Administrator roles, shared access, and joiner and leaver procedures
Business email
Available email protection settings, forwarding arrangements and handling of suspicious messages
Devices
Protection, encryption and configuration evidence for the agreed sample
Software and updates
Supported software, patch arrangements and available status records
Network and remote access
The office boundary, remote connections and responsibility for supplier access
Backups and recovery
Coverage, recent backup evidence, retention and existing restore-test records
People and policies
Practical staff guidance, payment verification and security responsibilities
Continuity
Critical services, recovery priorities and alternative working arrangements
Incident preparation
Contacts, escalation steps and responsibility when an incident is suspected
The review records where evidence is incomplete or unavailable. We do not assume that an unverified control is working.
What you receive
- A concise management report describing the agreed scope and evidence reviewed.
- A prioritised action plan explaining each finding, its business impact and the recommended next step.
- A record of sampling, exclusions and controls that could not be verified.
- A 30-minute findings call to discuss priorities and questions.
Actions can be assigned to your existing provider or used to request a separate improvement proposal from Oblyx. You remain in control of the next step.
How the review works
1. Introductory discovery. We spend around 20 minutes understanding your business, concerns, environment and existing providers. This free call determines fit; it is not the review itself.
2. Agree the work. We confirm the scope, nominated customer contact, evidence checklist and authorised access before booking.
3. Review the evidence. We use a scheduled remote session and relevant configuration records. You may share your screen, or agree temporary access limited to the work required. You never need to email your password.
4. Discuss the findings. You receive the report and we explain which actions deserve attention first. Any implementation is quoted separately and requires your agreement.
We agree the review session and report delivery dates in writing, taking account of the evidence available and the time needed from your team.
What to have ready
Please nominate a person who can explain your business priorities and authorise access. We will request a user/device list, relevant Microsoft 365 configuration evidence, software and protection status, backup information, existing recovery-test records and details of the providers responsible for your systems.
We agree the exact evidence and secure transfer method first. Redact unrelated information and avoid sending mailbox contents, client files, credentials or recovery codes. Missing evidence is recorded and may limit the conclusions.
A practical example
A small firm has MFA enabled for most staff, but an old administrator account remains active and nobody can produce evidence of a recent restore test. The review would explain those findings and recommend named ownership, an access change and a separately planned recovery test. It would not label the whole business secure because one setting looked correct.
Frequently asked questions
Does £395 include fixing the problems?
The fee covers the agreed review, report, action plan and findings call. Configuration changes, training delivery, new licences and recovery tests are separate work. We explain any proposed cost before you decide.
Is every device tested?
No. The standard review uses available management evidence and direct checks of up to three agreed representative devices. The report states what was checked. Broader inspection requires a separate scope.
Is this penetration testing or certification?
No. It does not include exploitation, vulnerability scanning, phishing simulations, independent certification or a formal compliance opinion. It is a structured review to identify practical improvements.
Will the review disrupt the business?
The review is observational. We do not change settings as part of the standard package. We agree access and sessions in advance so staff know what is needed.
What if we have more than 10 users or devices?
We can discuss a separate scope and price. The fixed package must fit the environment; we will not omit relevant complexity simply to keep the standard price.
Can our current IT company attend?
Yes. Their involvement can make evidence collection and action ownership easier. We agree roles with you before the session.
What if the evidence points to an active compromise?
We will flag the concern to the authorised contact and discuss an appropriate escalation. Investigation and incident response are outside the standard review and need separate arrangements.
Start with a short conversation
Tell us your business size, whether you use Microsoft 365 and the concern you want to address. We will establish whether the standard review fits before you commit.
Explore cybersecurity and resilience · Microsoft 365 support
Speak with Oblyx
Make protection part of a better working business.
Tell us what has prompted your enquiry. We will agree the right starting point with you.