Microsoft 365 & Google Workspace posture
See every tenant. Fix every gap. Keep it fixed.
Pistos Pharos checks the security settings, MFA gaps, admin roles and third-party app grants in every tenant you look after, shows the exact fix for each gap, and tells you when one drifts back. It is read-only, so nothing in a tenant changes unless you change it.
- Read-only access
- Nothing to install
- Free plan, no card
Early access is by invitation. The catalogue has 61 checks today; connecting a live tenant is not open yet. Planned pricing starts at $149 a month for every tenant.
Portfolio
Example data, not real companies
5tenants
61 checks mapped
- Hardened
Northwind Dental
Microsoft 365
92All checks pass
- Drift
Contoso Legal
Microsoft 365
81External forwarding switched on
- 3 to review
Fabrikam Logistics
Google Workspace
743 third-party apps can read mail
- Failing · 14 accounts
Tailspin Clinics
Microsoft 365
58Legacy sign-in still allowed
- Hardened
Adventure Works Co-op
Google Workspace
88Reviewed 12 days ago
Before you connect anything
Start with what the internet can already see.
Enter a domain to read its public mail and identity records. No sign-in, no tenant access.
Free, no sign-in. Reads public DNS records and Microsoft’s public sign-in discovery for the domain, and shows only what they return.
The workflow
From first scan to the evidence, in seven steps.
Most security gaps in cloud workspaces are not zero-days. They are settings left at default, or weakened during a busy week. Pharos is built around the work that follows: understand each tenant, then keep it that way. Steps marked Planned are not built yet.
Understand every tenant
Assess answers one question for each tenant: where do we stand today?
- 1
CheckPlanned
By hand
Open the Entra and Google admin consoles tenant by tenant and tick settings from memory.
With Pharos
Connect read-only once. 61 checks run against the tenant, and each one names the accounts it affects.
- 2
Map
By hand
Copy findings into a spreadsheet and match each one to a CIS or SOC 2 control by hand.
With Pharos
Every check is already mapped to CIS, SOC 2, ISO 27001, NIST CSF 2.0 and NIST 800-171.
- 3
ReportPlanned
By hand
Rebuild the same report for every client before every review.
With Pharos
A PDF per tenant under your own name, and one view of the whole portfolio.
- 4
FixPlanned
By hand
Hunt for the right PowerShell command, then hope the change does not lock someone out.
With Pharos
The console path or command, and the accounts a change would touch. You make the change; Pharos never does. Re-check to confirm it held.
Keep them hardened
Watch answers the next question: is it still that way, and can we show it?
- 5
Detect driftPlanned
By hand
Learn that a setting was weakened when the next audit finds it.
With Pharos
An alert by email, Slack, Teams or webhook when an admin weakens sharing, turns off MFA or adds a Global Admin, with the step to undo it.
- 6
ReviewPlanned
By hand
Run quarterly access reviews in spreadsheets and chase signatures by email.
With Pharos
Access review campaigns with a named reviewer and a signed PDF certificate, and every third-party app graded by scope risk.
- 7
ProvePlanned
By hand
Assemble screenshots for the auditor the week before.
With Pharos
Passing checks go to Kanon as evidence, and newly found OAuth vendors go to Pistos for review.
Who it is for
The same checks, whether you run one tenant or a hundred.
Your own tenant
One person, one tenant, a long list of defaults.
- See which accounts lack MFA and who holds an admin role, in plain English.
- Get the exact fix for each gap, and the accounts a change would affect before you make it.
- Start on the Free plan. Add layers when the audit questions begin.
MSPs and vCISOs
Every client tenant on one screen, at one price.
- Score and rank every client tenant, then open the one that needs you today.
- Branded PDF reports for each client review, without rebuilding them by hand.
- A flat price for every tenant: a client with 300 people costs the same to cover as one with 15.
61
checks in the catalogue today, each with its fix
5
frameworks every check maps to
500
tenants on one flat price
0
permissions that read mail, chats or files
Metadata, not content
A security tool should not become a second place your documents live.
Pharos inspects configuration metadata only. It requests no permission that can read a message, a file or a chat, and it never asks for one that can change your tenant.
Read the full permission list- MFA state, admin role assignments and sign-in timestamps
- Conditional Access, sharing and mail-flow policies
- Third-party OAuth app grants and their permission scopes
- Email bodies, attachments or calendar descriptions
- Files in OneDrive, SharePoint or Google Drive
- Teams or Google Chat messages
Pricing
Assess first. Add Watch when tenants need to stay that way.
Assess is $149 a month for every tenant. Watch is a flat $149 a month on top. No per-seat fees, no per-tenant fees.
Early access. Accounts are by invitation and nothing is billed yet. This is the price list Pharos will launch with. Lines marked Planned are not built yet.
Assess
Assess$149a month
Every tenant, one flat price. Billed once a year.
Understand every tenant you look after: check it, map it to the frameworks, and report on it.
- Up to 500 connected tenants at one flat price
- Up to 1,000 accounts per tenant
- Daily scheduled checksPlanned
- 90 days of history
- Posture checks with the fix for each gapPlanned
- CIS, SOC 2, ISO 27001 and NIST mappings
- Re-check on demandPlanned
- Third-party OAuth app inventory and risk gradingPlanned
- White-label PDF reportsPlanned
- Portfolio view across every tenantPlanned
Watch
Watch+$149a month
Flat add-on to Assess. Billed once a year.
Keep tenants hardened after you fix them: know when a setting weakens, run the reviews auditors ask for, and send the evidence on.
Everything in Assess, plus:
- Every 6 hours scheduled checks, not dailyPlanned
- 12 months of history, not 90 days
- Drift alerts by emailPlanned
- Slack, Teams and webhook alertsPlanned
- Quarterly access reviews with a signed PDFPlanned
- Evidence sync to KanonPlanned
- Vendor push to PistosPlanned
- Single sign-on (OIDC and SAML)Planned
- Read API with keysPlanned
Both together: $298 a month. Assess $149 plus Watch, billed once a year ($3,576). Watch applies to every tenant on the account, and each layer covers up to 500 connected tenants.
Free: $0
1 Microsoft 365 or Google Workspace tenant, up to 25 accounts, checked weekly, with 30 days of history.
Enterprise and education
More than 500 tenants, a longer history, or terms of your own: talk to us.
Questions
Plain answers.
See every gap in every Microsoft 365 and Google Workspace tenant.
Pharos is in early access: request a place, and connect with read-only permissions when it opens. Planned pricing starts at $149 a month for every tenant, with no per-seat fees.