Compliance
FFIEC CAT to NIST CSF 2.0: What Changed for Your Bank
Security Insights reporting aligns with the documentation requirements of the new NIST CSF 2.0 framework.
Read article
Guardian Security Insights
Monthly Security Reports Your Examiner Will Actually Read.
Security Insights translates your Microsoft 365 telemetry into examiner-ready reports. Secure Score trends, MFA coverage gaps, threat summaries, and compliance posture, delivered monthly so you are never surprised during an examination.
93% Avg. Secure Score post-hardening
Monthly Automated delivery cadence
750+ Financial institutions served
6 Core report sections
Report Contents
Fourteen reports. Five risk families. Every month.
Each report answers a question a regulator, a board member or a new IT director will eventually ask, and each one carries the detail behind the number so the work can be assigned the same day it is read.
Security Grade
Daily Security Grade Management
Microsoft Secure Score tracked every day, with category breakdowns and the open recommendations ranked by the points they carry. Shows where you improved, where you slipped, and what is still on the table.
Security Grade
Accepted Risk Register
The controls you have formally accepted rather than implemented, each with a named owner and a review date. This is the page an examiner asks for when your score is not 100 percent.
Identity and Access
MFA User Risk
Every user who can still sign in with a password alone, named, with the method each enrolled account uses. Microsoft reports that multifactor authentication can block over 99.9 percent of account compromise attacks. Service accounts are excluded by setting Employee Type in Microsoft Entra ID.
Identity and Access
Policy Exclusion Risk
Accounts excluded from your Conditional Access policies, and how long each exclusion has stood. Exclusions added for troubleshooting are the ones that outlive their reason.
Identity and Access
Active Admin Accounts
Users holding a directly assigned privileged role in Microsoft Entra ID. Microsoft recommends no more than five Global Administrators where Privileged Identity Management is not in use. Roles held through a group, and roles held by applications, are reviewed separately with your engineer.
Identity and Access
Stale Account Risk
Accounts with no sign-in activity for 61 days or more that still hold a license. Dormant accounts are both a cost and an open door, and they are the most common thing an offboarding checklist misses.
Identity and Access
Email Priority Activities
Your designated Priority Accounts, the executives and finance staff attackers research by name, and whether that list still matches who holds those roles today.
Devices
Unmanaged Device Risk
Devices reaching Microsoft 365 that are not enrolled in Microsoft Intune, so no security policy, patch level or encryption state is enforced on them. Conditional Access can require enrollment.
Devices
Microsoft Defender Risk
Devices not reporting Microsoft Defender for Endpoint as installed, active and current. A device that does not report cannot be included in an incident investigation.
Devices
Stale Device Risk
Registered devices that have not connected successfully in 90 days. Equipment that was never retrieved from a departing employee stays trusted until somebody removes it.
Devices
OS Lifecycle and Patch Risk
Operating systems approaching or past Microsoft support, combined with how many revisions behind current each device sits. Unsupported systems are a primary route in, because the fix does not exist.
Data Protection
DLP Policies Triggered by Users
Microsoft Purview data loss prevention events by user and by policy, so you can see whether a pattern is a training problem, a workflow problem, or one person. A concentrated pattern is usually the workflow.
License and Spend
Stale License Risk
Licenses assigned to users with no recent sign-in activity. Each one is both an avoidable cost and a dormant account, which is why it overlaps with Stale Account Risk by design.
License and Spend
Unused License Leak
Licenses you are paying for that are assigned to nobody, by subscription, with how long each has sat idle. Your account manager can adjust monthly counts so you pay for what is in use.
Examination Ready
Built for the questions examiners actually ask.
FFIEC, NCUA, and state examiners evaluate your cybersecurity program through documentation. Security Insights generates that documentation automatically, so your team spends time on security, not on building reports.
During an examination, your IT team typically scrambles to pull data from multiple dashboards, export spreadsheets, and assemble ad-hoc reports. Security Insights ends that scramble by delivering the same report every month.
Your examiner receives a consistent format they can compare period over period. Your compliance team keeps a running archive that proves continuous monitoring, not just point-in-time snapshots assembled the week before an exam.
- "How do you monitor your Microsoft 365 security posture?" Secure Score trends with monthly cadence.
- "What is your MFA coverage?" User-level enrollment report with gap identification.
- "How do you detect and respond to anomalous sign-ins?" Sign-in risk report with flagged events.
- "How do you prevent data exfiltration?" External sharing and DLP compliance reporting.
See what your examiner will see. Before they do.
Request a sample Security Insights report. We will show you the format, the data sources, and what a monthly report looks like for an institution your size.
Request Sample ReportHow It Works
Automated collection. Human analysis. Monthly delivery.
Security Insights runs on the same Azure automation stack that powers Guardian monitoring. Data flows from your Microsoft 365 tenant through Logic Apps and Azure Functions into a reporting pipeline. ABT's security team reviews the automated output, adds context for your specific environment, and delivers the final report.
This is not a dashboard you need to log into. It is a report that arrives in your inbox, ready to forward to your board, your examiner, or your compliance committee. The same report format every month means you can track trends without learning a new tool.
Common Questions
Frequently asked questions
Each monthly report covers fourteen reports across five risk families: security grade, identity and access, devices, data protection, and license and spend. Every report names the specific users, devices or policies behind its number, and carries the steps to close the gap.
Reports are delivered monthly. The same format arrives every month so your compliance team can track trends period over period. The underlying data refreshes nightly, so a change shows up in the next report rather than a month later. The consistent format means examiners see a continuous monitoring program, not a point-in-time snapshot.
Security Insights is included with Guardian Foundation, which also covers tenant hardening and drift monitoring against the Guardian baseline. Foundation is included when your Microsoft 365 licensing runs through ABT as your Cloud Solution Provider. If you would rather see your own numbers first, ask for a tenant security grade assessment and we will walk you through what it found.
Yes. The reports are designed specifically for examiner consumption. FFIEC, NCUA, and state examiners evaluate cybersecurity programs through documentation. Security Insights provides that documentation in a consistent monthly format that demonstrates continuous monitoring, threat awareness, and compliance posture management.
Reports pull data from Microsoft Secure Score, Entra ID sign-in logs, Defender for Office 365, Microsoft Purview DLP alerts, SharePoint and OneDrive sharing audit logs, and Intune device compliance. ABT collects this data through the Azure automation stack that powers Guardian monitoring, requiring no additional software installed in your environment.
Talk to an Expert
See a Sample
Insights Report?
Request a sample Security Insights report to see exactly what your examiner will receive. Same format, same fourteen reports, illustrated with a representative environment.
SOC 1 Type II · Security Controls
SOC 2 Type I
Tier-1 CSP
Zero Trust Baseline
25+
Years serving FIs
750+
Institutions protected
6
Report sections
Request Your Sample Report
See what monthly Security Insights looks like.
Sample Report
Security Insights Demo
Guardian Pricing
Audit Preparation
First name is required
Last name is required
Valid email is required
Response within 1 business day. No obligation.
You are in.
An ABT security analyst will prepare a sample report and reach out within one business day.
Encrypted. Private. Never shared.
