What we check
We check your tenant against a catalogue of 45 controls. Each control is one specific setting, with its evidence and the published sources behind it. They cover Microsoft Entra ID, Intune, Defender, Exchange Online, SharePoint and OneDrive, Teams and Purview, and the DNS records that protect your mail.
Controls are assessed against what your tenant's licences expose: with fewer licences, more controls are reported as not established. Holding a licence is not the same as having it configured.
Findings are grouped by area: identity, email, endpoint, collaboration and data.
First, what we could see
- Every document states coverage before findings.
- What we could not see is reported as not established, never as a pass.
- Below 30% coverage, we give no score.
- Microsoft's Secure Score appears beside ours, never blended into it.
The score and the grade
The score is the share of the assessed controls that are in place, weighted by each control's points, out of 100. The grade is the band it falls in: A from 85, B from 70, C from 55, D from 35 and F below 35. The grade means that and nothing more.
A plan in the right order
We order the fixes by what depends on what and group them in waves, sized in hours. We tell you how many findings close just by configuring what you already hold. Purchases sit apart, in their own budget lane, so they are decided separately.
Where it helps, a second view places Huntress services at the phase where each one helps and says why. Findings and figures are the same on both views.
A finding is closed when the next assessment reads its control as in place.
What you receive
- Executive summary — for management and the board, non-technical
- Technical findings — for your engineer: every control and its evidence
- Wave delivery plan — for the delivery team: tasks and effort
- Evidence package — every control's dated evidence and the method, with no plan
- Quotation — a proposal for the remediation plan, for whoever signs
- C-level brief — three to four pages for the C-suite
In PDF and Word, in English or Spanish. Every assessment says what changed since the previous one.
An assessment, not an audit
It is a point-in-time assessment. It is not an audit or a certification, and it gives no compliance score against any framework.
Nor is it an independent opinion: we are the firm that can also do the remediation, and the plan prices that work at our rates. And it is not continuous monitoring: round-the-clock watching is done by Huntress.