Beacon is a one-day risk assessment for small and medium businesses. We check your identity security and devices, see how your team uses AI tools, scan for brand exposure and data breaches, and hand you a plain-English report. No software to install and no subscription. Microsoft 365 unlocks a few extra automated checks, but it isn't required.
Seven areas, checked systematically: automated wherever your systems allow, backed by a structured interview everywhere else.
MFA adoption, conditional access, admin role assignments, and stale or ex-employee accounts still active in your directory.
Files and folders shared externally or through anonymous links: the most common source of accidental data leakage in SMEs.
Patch status, malware protection and compliance across managed devices, flagging anything out of date or unprotected.
Which AI tools (ChatGPT, Copilot, Gemini and others) are in use, and whether sensitive data may be leaving the business through them.
A gap analysis across the five Cyber Essentials controls: firewalls, secure configuration, access control, malware protection and patching.
A light-touch review of data flows, processors, breach readiness and record-keeping, as a practical checklist rather than a legal opinion.
Whether your domain appears in known breaches, lookalike domains, services exposed to the internet, and reputation flags.
A short checklist. On Microsoft 365, your admin grants read-only access in about 10 minutes to unlock extra automated checks; otherwise we cover the same ground on the day.
We run the Beacon toolkit against your environment while a structured interview covers the GDPR and Cyber Essentials areas that can't be read automatically.
A plain-English report with findings rated by severity and a prioritised action list, suitable for insurers, supply-chain contacts or your board.
Sized for micro-businesses and small teams.
Our most common size: more accounts, devices and data to cover.
Larger SMEs, still delivered in a single day.
More than 250 employees or several sites? Ask for a quote. Beacon is a consultancy service, not software: we assess, report and leave, and you own the findings. Follow-up assessments are quoted separately.
No. Microsoft 365 unlocks a few extra automated identity and device checks, but AI tool usage, brand exposure, GDPR and Cyber Essentials alignment are checked either way. Anything we can't check automatically is covered by interview.
No. It is a structured risk assessment and gap analysis. ISO 27001 certification and Cyber Essentials certification (issued only by IASME-accredited bodies) are outside its scope. The report is an indicative posture check, not a certified audit.
Read-only access through a registered application in your Microsoft 365 tenant, granted by your admin before the visit. We never ask for write permissions, and you can revoke access at any time.
Yes. It is written to be shared with insurers and clients, and states clearly that it is an indicative risk assessment rather than a certified audit.