Security architecture built by engineers
who build security technology.
Microsoft 365, Entra ID, Azure, Defender, Purview, Sentinel and Cloudflare. Assessed, hardened and validated. Every engagement delivered by the engineers behind the ARRAC platform.
We build the security technology. We know how to secure the environment.
ARRAC is an autonomous cybersecurity platform provider. Our platform detects, investigates and contains Microsoft 365 threats without waiting for human instruction.
Our professional services team applies the same engineering expertise behind the ARRAC platform to security architecture, implementation and hardening. The engineers who design detection logic are the same engineers who harden your environment.
You receive a secure, validated environment with the option to extend protection through ARRAC's autonomous response platform. Consultancy and platform are independent. They are also complementary.
Learn about the ARRAC platform →Why work with ARRAC engineers?
Every engagement is run by the same engineers who designed the ARRAC detection and response platform. That depth of context does not exist at a general-purpose consultancy.
We designed the detection logic. We understand which security misconfigurations ARRAC detects, how they contribute to attack paths and which controls reduce exposure.
Every hardening engagement ends with measurable controls in place, verified against ARRAC's own detection logic. You know what changed, why it matters, and what we validated.
Clients who complete an engagement see exactly how ARRAC monitors and responds in their environment. The step from a single project to continuous autonomous protection is direct.
Every layer of the Microsoft and Cloudflare security stack.
Engagements are scoped to what you need. Most clients start with an assessment and leave with a hardened environment and a clear roadmap.
Entra ID hardening, Conditional Access policy design, Privileged Identity Management, MFA enforcement and guest access governance.
- Entra ID security baseline
- Conditional Access policy design
- PIM role configuration
- MFA enforcement and break-glass accounts
- Guest and external collaboration controls
Intune policy design, Defender for Endpoint configuration, device compliance baselines and mobile device management.
- Intune compliance and configuration policies
- Defender for Endpoint deployment
- Device compliance baselines
- Application control policies
- Windows Autopilot configuration
Microsoft Purview information governance, retention label taxonomy, eDiscovery configuration and compliance posture assessment.
- Purview retention label design
- Sensitivity label taxonomy
- DLP policy baseline
- eDiscovery configuration
- Compliance posture assessment
Azure security posture, Defender for Cloud configuration, Sentinel workspace design and security information and event management.
- Azure security baseline
- Defender for Cloud enablement
- Microsoft Sentinel workspace design
- Log Analytics and data connector configuration
- Analytic rule and workbook deployment
Exchange Online protection, Defender for Office 365, anti-phishing policy design and Teams governance.
- Exchange Online Protection configuration
- Defender for Office 365 policies
- Anti-phishing and anti-spoofing baselines
- Teams security and guest policies
- DMARC, DKIM and SPF validation
ARRAC includes native Cloudflare and Azure WAF integrations, extending its Microsoft-first security architecture into web application protection. Our professional services team designs and hardens customer-facing web security infrastructure.
- WAF rule design and deployment
- Bot management and DDoS mitigation
- Zero Trust Access policies
- Rate limiting and geo-filtering
- Azure WAF policy design
Clear pricing. No retainer required.
Day rate engagements are priced by service type. Fixed packages are available for common hardening workstreams with a defined scope and output.
- Policy configuration and deployment
- Intune and Defender baseline implementation
- Exchange Online protection configuration
- Retention and sensitivity label deployment
- Security architecture design and review
- Conditional Access and PIM strategy
- Sentinel workspace and analytic rule design
- Cross-workload security roadmap
- Active incident response and containment
- Board-level security advisory
- Virtual CISO engagements
- High-urgency, high-risk architecture
- Scoped to a specific workstream
- Fixed deliverables agreed upfront
- Validation against ARRAC detection logic
- Written findings and recommendations
- No retainer, no ongoing commitment
Hardening packages for common workstreams.
Each package has a defined scope, defined deliverables and a fixed price. No surprises.
A comprehensive review of your Microsoft 365 security posture against the ARRAC platform baseline. Written findings, prioritised by risk.
- Entra ID and Conditional Access review
- Exchange and Defender posture check
- Prioritised remediation roadmap
- Written report with evidence
Full Entra ID security implementation: Conditional Access, PIM, break-glass accounts, MFA enforcement and guest access controls.
- Conditional Access policy suite
- PIM role and approval workflow
- Break-glass account provisioning
- MFA enforcement baseline
- Guest access governance
Microsoft Purview retention and sensitivity label taxonomy, DLP baseline and eDiscovery configuration aligned to your compliance requirements.
- Retention label taxonomy design
- Sensitivity label suite
- DLP policy baseline
- eDiscovery configuration
Comprehensive hardening across identity, endpoint, email and cloud. The complete Microsoft 365 security baseline, implemented and validated.
- Everything in Entra ID Hardening
- Defender for Endpoint baseline
- Exchange Online Protection configuration
- Defender for Office 365 policies
- Teams and SharePoint governance
- Validated against ARRAC detection logic
Azure security posture hardening, Defender for Cloud enablement and Sentinel workspace design with analytic rules and log connectors.
- Azure security baseline
- Defender for Cloud configuration
- Sentinel workspace design
- Log connector and analytic rule deployment
WAF policy design, bot protection and Zero Trust access for Cloudflare and Azure environments. Integrates with ARRAC's autonomous detection and response pipeline.
- Cloudflare WAF rule design and deployment
- Azure WAF policy design
- Bot management and DDoS tuning
- Zero Trust Access policies
- ARRAC platform integration
From first conversation to hardened environment.
A straightforward process. No lengthy procurement. No discovery phase that runs for weeks before any work begins.
We discuss your environment, priorities and any specific concerns. We confirm the right package or agree a day rate scope. No obligation. No sales pitch.
You receive a written proposal within 48 hours. Scope, deliverables, price and timeline stated clearly. No ambiguity about what is and is not included.
Delivery is remote. Assessments use least-privilege read access. Implementation requires explicitly approved write permissions, controlled change windows and documented rollback procedures. Most engagements complete within 5 days.
Controls are validated against the ARRAC platform baseline before we close. You receive written findings, a remediation record and a roadmap for anything out of scope.
Common questions.
No. Consultancy services are available as standalone engagements. That said, clients who use the platform alongside an engagement get the most value, since we can validate controls directly against live detection coverage.
Fixed packages run up to 5 days. The ARRAC Security Review is typically 1 to 2 days remote. Full Stack Hardening is 3 to 5 days. Day rate engagements are scoped individually. We do not start work until scope and timeline are agreed in writing.
Read access to the relevant workloads is required for assessments. Hardening work requires specific write permissions agreed in advance, applied within a change window you control. We do not request Global Administrator unless it is genuinely required and we will document why.
You receive a written report with findings, the changes made, and a prioritised roadmap for anything out of scope. Clients who move to the ARRAC platform after an engagement start with a fully validated baseline. There is no ongoing commitment required from consultancy alone.
Yes. We offer a virtual CISO advisory day rate for organisations that need periodic security oversight, board reporting or architecture review on a retainer basis. Contact us to discuss requirements.
Day rate work has a 2-day minimum. Fixed packages have no minimum beyond the package price. There is no retainer requirement. You can engage for a single defined piece of work and nothing more.
Start with a conversation.
Tell us what you are working on. We will confirm whether a fixed package covers it or whether day rate work is the right fit, and get a proposal to you within 48 hours.
All consultancy is delivered by the engineers who build and operate the ARRAC platform. If the engagement leads naturally to platform coverage, we will tell you. There is no pressure to subscribe.