Skip to content
Book a risk assessment

Hardened.

The settings attackers check first, set right and kept right.

Identity, email and devices configured to the Essential Eight and CIS Benchmarks. Every change is tested before it reaches everyone, and drift is caught daily.

Price
$2,900 one-off, then $1 per user monthly
Standards
Essential Eight, CIS Benchmarks
Kept right
Drift checked daily
Northbank Advisory · Configuration scoreExample
54

MFA was on, but admins shared accounts, old sign-in methods were open and every laptop had admin rights.

  • Identity · MFA on every accountDone
  • Identity · Phishing-resistant MFA for adminsMissing
  • Identity · Separate admin accountsMissing
  • Identity · Old sign-in methods blockedMissing
  • Identity · Risky sign-ins blockedMissing
  • Email · Anti-spoofing recordsPartly
  • Email · Lookalike sender warningsMissing
  • Devices · Local admin rights removedMissing
  • Devices · Internet macros blockedDone
  • Devices · Disk encryption onDone
Four areas

Where most break-ins actually start.

Stolen passwords, spoofed email and laptops with admin rights cause most small-business incidents. Hardened closes those first.

01

Identity

MFA on every account, phishing-resistant MFA and separate accounts for admins, risky and old-style sign-ins blocked.

02

Email

Anti-spoofing records, lookalike sender warnings and safe attachment handling.

03

Devices

No local admin rights, macros from the internet blocked, encryption and screen lock everywhere.

04

Baselines

Settings matched to the Essential Eight and CIS Benchmarks, written down so you can prove it.

How changes roll out

Tested first, so nobody gets locked out.

A security setting that stops people working gets switched off by Friday. So every change earns its way in.

Weeks 1 to 2

Report only

Each change runs in report mode. We see exactly who and what it would affect.

Week 3

Pilot

IT and a volunteer from each team get it first, with a rollback ready.

Week 4

Enforce

Everyone, after the pilot is clean. Exceptions are named, with a reason and an end date.

Every day after

Drift watch

Settings are compared with the approved baseline. Changes are flagged the same day.

Drift watch

Settings drift. We notice the same day.

Good settings get undone by well-meaning admins, new tools and quick fixes. Every change to your baseline is checked against approved changes.

Drift detected · Tue 11:42Example
What changed
A sign-in rule exclusion was added for an account called "temp-contractor".
Who
Your managed IT provider's admin account
Approved change?
No
Outcome
Sam confirmed it wasn't needed. Reverted at 12:10.
Essential Eight

Where Northbank started, and where Hardened took it.

Maturity levels run from ML0 to ML3. Most small businesses should aim for ML2. Backups stay with your IT provider; we check the restores.

Essential Eight maturity · Northbank AdvisoryExample
Essential Eight maturity before and after
StrategyBeforeAfterWho
Patch applicationsML1ML2With Fix First
Patch operating systemsML1ML2With Fix First
Multi-factor authenticationML1ML2Hardened
Restrict admin privilegesML0ML2Hardened
Application controlML0ML1Hardened
Restrict Office macrosML1ML2Hardened
User application hardeningML0ML2Hardened
Regular backupsML1ML1Your IT provider, checked by us
Price

One-off setup, then $1 per user a month to keep it right.

The setup covers all four areas and the staged rollout. The monthly fee is drift watch. In this example, Northbank's 40 people come to $40 a month.

Price by size
Your sizeSetup, one-off
Up to 50 people$2,900
Up to 150 people$4,350
Up to 300 people$5,800
Up to 500 people$7,250

Bigger than 500? We'll price it with you.

Find out which settings attackers would check first at your business.

Groundwork tells us where to start, so Hardened fixes your biggest gaps first.

Book Groundwork