Security Health Check
A free, no-obligation review of your Microsoft 365 security posture — honest findings, no sign-up.
A complimentary, no-obligation Security Health Check and Microsoft 365 security posture assessment for your organisation - no sign-up, just an honest picture of where you stand.
Most businesses don't find out how exposed they really are until something goes wrong. Reflective IT's engineers will assess your Microsoft 365 tenant, endpoints and email security free of charge, and tell you honestly what we find - good or bad.
The health check is carried out by the same engineers who deliver our Cyber Resilience Uplift and Cyber Essentials work, benchmarked against the official Cyber Essentials controls and everyday cyber insurance requirements. There's no obligation to act on what we find, and no cost either way.
- Multi-factor authentication and Conditional Access coverage across your tenant.
- Email authentication - DMARC, SPF and DKIM - and your real-world exposure to spoofing.
- Antivirus and EDR coverage across your endpoints and devices.
- Device management and patch status across your fleet.
- Backup configuration and ransomware resilience.
- Overall alignment with the government-backed Cyber Essentials framework.
Most businesses don't know their real security posture until it's tested
In our experience, the gaps that cause the most damage are rarely the ones businesses expect. Our free Security Health Check finds them before an attacker, an insurer, or an auditor does.
We regularly uncover:
- Legacy authentication still enabled, letting compromised accounts be accessed from anywhere in the world.
- MFA switched on for some users but not enforced consistently across the whole organisation.
- DMARC records left in monitor-only mode, or missing entirely, leaving the domain open to spoofing.
- Devices with inconsistent, expired or missing antivirus and EDR coverage.
- Backups that run every night but have never actually been tested with a real restore.
- No centralised visibility of security events across the Microsoft 365 tenant.
What's included in your Security Health Check
Every health check covers the same six areas, carried out by hand by our engineers rather than an automated scan:
Microsoft 365 Security Posture Review
We review your tenant’s Microsoft Secure Score, configuration baseline and licensing against current best practice.
Identity & Access Review
We check MFA enforcement, Conditional Access policies and legacy authentication across every account in your tenant.
Email Security Check
We test your DMARC, SPF and DKIM records and assess your real-world exposure to spoofing and phishing.
Endpoint & Device Review
We review antivirus and EDR coverage, patch status and device management across your entire fleet.
Backup & Recovery Review
We check what’s actually being backed up, how often, and whether it’s genuinely protected against ransomware.
Cyber Essentials Readiness Gap Analysis
We benchmark your current setup against the five official Cyber Essentials controls and flag exactly what would need to change.
Your Security Health Check is benchmarked against Cyber Essentials and cyber insurance requirements
Whether you're pursuing Cyber Essentials certification, satisfying a cyber insurer, or simply want to know where you stand, your report maps directly onto the five official Cyber Essentials control themes:
- Secure configuration - are your Microsoft 365 tenant settings hardened, or still sitting on risky defaults?
- Malware protection - is antivirus/EDR installed, up to date and consistently enforced across every device?
- Patch management - are operating systems and applications being kept automatically up to date?
- Access control - is MFA enforced everywhere, with legacy authentication fully blocked?
- Firewalls & gateway protection - are malicious domains and connections being blocked before they reach your devices?
What you get from your Security Health Check
Every prospective client who takes up a Security Health Check receives:
An honest, jargon-free picture
Straight talk from our engineers about your actual risk level - no scare tactics, no sales pitch.
A prioritised remediation roadmap
Every finding is ranked by risk, so you know exactly what to fix first if you choose to act on it.
Zero cost, zero obligation
The health check is entirely free and comes with no obligation to sign up to any further service.
Delivered by the engineers who’d do the work
The same team who deliver our Cyber Resilience Uplift and Cyber Essentials work carries out your assessment.
Assessment criteria aligned to Cyber Essentials
Findings are benchmarked against the official, government-backed Cyber Essentials framework.
A natural, no-pressure first step
Many clients use their health check as the starting point for a Cyber Resilience Uplift - but only if they choose to.
How it works
From your first message to a report in hand, the whole process is designed to be quick, straightforward and pressure-free.
Complementary services
If your health check turns up gaps you'd like to close, many clients follow up with:
Cyber Resilience Uplift
Cyber Essentials Certification
Managed DMARC
Ready to find out where you stand?
Get in touch for your free, no-obligation Security Health Check. We've been making IT effortless for businesses since 2003.
Request a Proposal
Learn about Cyber Resilience Uplift
Further reading
Free O365 Secure Score Report for Your Business
Free O365 Secure Score Report for Your Business What Is Microsoft Secure Score? Microsoft Secure Score is a built-in security analytics tool that measures your organisation’s security posture...
Improve Your Security Posture with Microsoft Secure Score
Improve your security posture with Microsoft secure score What is Microsoft Secure Score? Microsoft Secure Score is a built-in security analytics tool within Microsoft 365 that measures your...
Cyber Security for SMEs: A Practical UK Guide
Cyber security for an SME does not need to begin with a costly programme or a long list of tools. It starts with knowing what your business depends...
