Practice a real attack on a copy of your Microsoft environment.
We rebuild your Microsoft 365 setup in an isolated range, with made-up people and data. Your red team attacks it with AI agents. Your blue team defends it with AI agents. When it's over, you know where you're weak, and we can help you fix it.
Request a scoping callExercises start at $9,500 CAD, plus tax.
How it works
-
The scoping call
We talk through your Microsoft setup and what worries you most. You choose what to share, and we don't need access to your real tenant.
-
We build the copy
We rebuild your identities, policies, devices, mail and files in a range we run, along with the security tools you use. We build it from what you tell us. If you'd rather share less, we work from public information about your organization, such as job postings and blog posts, the way a real attacker would. The copy is cut off from your real tenant.
-
Exercise day
Your red team steers AI agents that attack the copy the way intruders go after Microsoft tenants: phishing, stolen sign-in tokens, mailbox rules and over-shared files. Your blue team uses AI agents to triage the alerts and hunt through the logs. The standard exercise is one day. You can book a longer one.
-
The report
You get a written report that shows each step the attackers took and whether your defenders caught it. It ends with a ranked list of fixes.
-
Hands-on fixes
If you want help, we make the fixes with your team in your real tenant. You approve every change before we make it.
No red team? That's fine.
The agents carry out the attack. Your IT staff steer them, and they don't need a hacking background.
Why we use a copy
Because it's a copy, the attack can go all the way without breaking anything real. Nobody gets locked out and no real data leaves. After you've made the fixes, we can run it again to check they hold.
Insurance and audits
Cyber insurance applications often ask whether you've tested your incident response plan. The CIS Controls call for an incident response exercise at least once a year. Bring your plan to the exercise and your blue team can follow it. Your report is a dated, written record of what happened.
Microsoft environments only
We only work in Microsoft environments: Entra ID, Exchange Online, SharePoint, Teams, Intune, Defender and Sentinel. It's what we know best. If most of your security runs on other vendors' tools, we're not the right fit.
Pricing
Exercises start at $9,500 CAD, plus tax.
That covers building the copy, a one-day exercise and the report. The final price depends on the size of your environment, how many people take part and how many days you book. You get a fixed quote after the scoping call. Hands-on fixes are quoted separately.
Request a scoping callAbout Thornwall
Thornwall Security is a small firm in Ottawa. Our founder has spent five years running detection and incident response on Microsoft's security tools, and builds every exercise personally.