Products / Stay secure / Softilo Assure
Security assurance
Softilo Assure
What an attacker would chain together, and what to fix first.
Assure connects read-only to your Microsoft 365 tenant, works out which weaknesses an attacker would actually combine, and gives you a fix list in the order that removes the most risk, mapped to Cyber Essentials and ISO 27001.
For UK small businesses on Microsoft 365
The problem
Small firms run on Microsoft 365 but rarely have security staff. Scanners list hundreds of findings with no sense of which matter, and a consultant’s report is out of date within weeks.
See it running
Softilo Assure on screen
What it does
7 things Softilo Assure does properly
Read-only connection
An administrator signs in with Microsoft and approves read-only access once. Softilo stores no customer passwords.
Attack-path risk model
Weaknesses are scored by the attack chains they open, such as invoice fraud, admin takeover and ransomware, rather than by counting failed checks.
A plan in the right order
Fixes are ranked by the risk removed and certification requirements completed per hour of work, and re-ranked after each step.
Signs of attack go first
Hidden or forwarding inbox rules and consent-phished apps go to the top of the plan, and everything maps to MITRE ATT&CK.
Cyber Essentials and ISO 27001
Readiness for both, tracking the controls that need a person’s attestation alongside the automated ones.
Evidence an auditor can check
Every verdict goes in a hash-chained ledger and exports as an evidence pack that can be checked without Softilo software.
Free email security check
A check of any domain’s SPF, DMARC and DKIM, with no sign-in needed.
Quality bars
Rules it doesn’t break.
- No AI in the scoring
- 34 deterministic checks and an explainable engine. No large language model sits in the scoring path.
- Unknown is never a pass
- A section that can’t be read, through a missing permission or licence, is reported as Unknown and becomes an action in the plan.
- Honest about timestamps
- Without an independent RFC 3161 timestamp service configured, an evidence pack reports as inconclusive.
- It doesn’t certify
- Assure helps you prepare. Certificates come from IASME-licensed and accredited certification bodies.
Specification
Under the bonnet
- Connects to
- Microsoft 365 via Microsoft Graph · DNS for email checks
- Mapped to
- Cyber Essentials · ISO/IEC 27001:2022 · MITRE ATT&CK techniques
- Stack
- Python · FastAPI · Next.js
- Output
- Dashboard · printable report · evidence pack
Straight answers
What it doesn’t do (yet)
- Scheduled scanning and drift alerts: scans run on demand today
- User accounts and role-based access
- Encrypted secret storage and a production database
- A review of the Cyber Essentials mapping against the current IASME question set
- A console for IT providers managing many clients
Need one of these now? We can build it for you as a services project.
See Softilo Assure for yourself.
Tell us a little about your business and we’ll arrange a call and a demo. No obligation, no hard sell.
Book a demoNext product
Threat detection and response
Softilo Defender →