01
Instant
Buy and download
The kit downloads instantly.
StepAhead 365 · For Microsoft 365 businesses, 5–200 employees
Stay compliant. Stay one step ahead of threat actors.
StepAhead 365 scans your Microsoft 365 tenant in about 5 minutes (read-only), finds the open doors attackers use first, maps each to CIS Controls v8 and NIST CSF 2.0, and hands you the evidence pack auditors and clients ask for.
The problem
Most breaches walk through doors left open.
22%Of breaches start with stolen or abused credentials, the #1 way in
88%Of small and mid-size business breaches involved ransomware
99%+Of unauthorized sign-in attempts are blocked by MFA
Attackers don't break in. They log in. Most small-business breaches use a door that was left open in settings you already pay for.
Sources: Verizon 2025 Data Breach Investigations Report; Microsoft Digital Defense Report 2025.
Free 2-minute security check
Ten questions. How many can you answer yes?
One point per Yes. Nothing you answer leaves this page.
What the scan checks
The doors attackers try first, checked against your tenant and mapped to the frameworks.
- MFA registration Every user and every adminScannedCIS 6.3–6.5 · NIST PR.AA-03
- MFA enforcement Security Defaults or Conditional AccessScannedCIS 6.3–6.5 · NIST PR.AA-03
- Legacy authentication blockingScannedCIS 4.8
- Global Administrator sprawlScannedCIS 5.4 · NIST PR.AA-05
- SPF, DKIM and DMARC For every domainScannedCIS 9.5
- EDR on every computer and serverYou attestCIS 10
- Immutable, tested backupsYou attestCIS 11
- Incident response planYou attestCIS 17
- Security awareness trainingYou attestCIS 14
- PatchingYou attestCIS 7
Read-only. Makes zero changes to your tenant.
What you get
A report, the evidence, and the paperwork auditors and clients expect.
Posture report
An HTML report with pass/fail, framework mapping and how to fix each gap.
Evidence CSVs
For audits, client security questionnaires and leadership:
- MFA registration
- Conditional Access policies
- Global Admin list
Templates
- Incident Response Plan
- Written Information Security Program (WISP), aligned to the FTC Safeguards Rule
- Quarterly Access Review
- Compliance Evidence Pack cover sheet
How it works
From download to evidence pack in one sitting.
02
About 5 minutes
Run one PowerShell command
Sign in with a Global Reader account.
03
Fix
Open your report, fix the red items, re-run
04
Share and repeat
Share the evidence pack
Share it with your auditor, clients or leadership, and re-run monthly to catch drift.
Pricing
One kit, a monthly watch, or a license for every client.
Launching soon
SMB Kit
$79 one-time
- Scanner
- Posture report
- Evidence CSVs
- 4 policy templates
Monthly Watch
$29 /month
- Monthly re-scan
- An alert when a setting drifts out of compliance, before an attacker finds it
MSP License
$299 /year
- Run it for unlimited clients
- White-label reports
Built by
Zach Powers automates identity governance for a living.
Senior Application Support Specialist automating identity governance and privileged access for a 17,000+ user enterprise environment. B.A.S. in Cyber Security.
17,000+Users in the environment he governs
8.5 → 1.5 hAverage resolution time, cut with automation
95%+Audit scores
FAQ
Common questions.
Does it change anything in my tenant?
No. It uses read-only Graph scopes.
Do I need special licensing?
MFA registration reporting may need Entra ID P1; the scan flags it if it isn't available.
Does it work on Google Workspace?
Not yet. Microsoft 365 only.
Is this a compliance certification?
No. It maps your settings to CIS Controls v8 and NIST CSF 2.0 to show gaps and evidence; it doesn't certify you.