Loading…
Services · Tech
Identity and access management
Most breaches now start with a login rather than a firewall. Getting identity right is the single highest value security work for a business of your size.£3,000 to £15,000
What identity and access management actually means
Identity and access management is the discipline of controlling who can get into what, and proving it. For years security was mostly about the perimeter: a firewall around the office, everyone inside trusted. That model has quietly collapsed. People work from home, on phones, from cafes, and the systems they use live in the cloud, so there is no perimeter left to defend. The login has become the real front door, and identity is how you lock it.
In practice it means getting the fundamentals genuinely right: a proper identity system such as Microsoft Entra ID, multi-factor authentication so a stolen password alone is not enough, and conditional access so a sign-in from an unusual place or an unmanaged device is challenged or blocked. It also means the dull, vital housekeeping: accounts created cleanly when people join, changed when they move roles, and actually switched off when they leave.
Beyond the basics it is a staged move toward what the industry calls zero trust, the principle of never assuming a login is safe just because it got past the front door, and of giving each person only the access their job needs. We sequence that carefully so nobody is ever locked out of the work they have to do, and we separate the powerful admin accounts from everyday ones so a single compromised login cannot open everything.
See it work
Rather than take our word for it
Which of these passwords would an attacker crack in seconds? Sort them and find out.
Sort each one
0/7 rightpassword1
Emma2015
qwertyuiop
n7Q!
Coffee123!
brass-lantern-tuesday-canyon
v9$Kp2!wLxQ7#mB
A scripted demonstration. Never type a real password into any website to check it, including this one.
How it helps your business
The blunt reason to do this is that most breaches now start with a login, not a hacked firewall. Attackers do not break the door down; they walk in with a password bought, guessed or phished. Multi-factor authentication alone stops the overwhelming majority of that, because the stolen password is no longer enough on its own. For the money, getting identity right is the single highest-value security work most businesses can do.
It also closes the quiet risk of the account nobody switched off. In a lot of small businesses, people leave and their logins live on for months, still able to reach email, files and systems, a standing open door that no one is watching. Handling joiners, movers and leavers properly means access ends when employment does, which removes a whole category of insider and ex-insider risk that most owners never think about.
And it makes working from anywhere safe rather than a gamble. Done well, identity lets your team be as productive at home or on site as in the office while being just as protected, because the checks travel with the person, not the building. That is what lets a modern business be flexible without quietly trading away its security to do it.
What is included
- Microsoft Entra ID, multi factor authentication and conditional access set up properly
- Joiners, movers and leavers handled so old accounts do not linger for months
- A staged move toward zero trust, sequenced so nobody is locked out of their job
- Privileged accounts separated from everyday ones
Real examples
Illustrative cases. Tap one to see what happened and what could have been done.
The password that was not enough on its own
The case
A member of staff at a finance firm was phished, their password captured on a convincing fake login page. In most businesses that stolen password is the start of a disaster, with an attacker free to reach email, files and systems.
What could have been done
Multi-factor authentication makes the stolen password alone worthless, so the attacker gets nowhere, and the blocked second-factor prompt is itself the warning that the password was compromised and needs resetting. For the money, it is the single highest-value thing to have in place.
The leaver who still had the keys
The case
At a growing agency, a dozen active accounts belonged to people who had left, some more than a year earlier, still able to reach email and shared files. Any one of them was a live risk, from a disgruntled ex-employee to an attacker who found an unused login.
What could have been done
A proper joiners, movers and leavers process ends access the day someone leaves, closing the standing open doors nobody was watching. It is dull, routine housekeeping that removes a whole category of insider and ex-insider risk.
Ready to sort identity and access management?
Tell us what is going wrong and we will come back with a fixed price in writing, after a short scoping call. No obligation, and no jargon.
Common questions about identity and access management
How much does identity and access management cost?
£3,000 to £15,000. We agree the exact number before any work starts, so there are no open ended day rates.
How long does identity and access management take?
Most work of this kind is live within three to four weeks. We give you a date before we begin and tell you early if anything threatens it.
Do you work outside Edinburgh?
Yes. We are based in Edinburgh and work on site across the Lothians, Fife and Glasgow, and remotely across the United Kingdom.
Identity and access management in your area
Same service, same prices, wherever you are. On site across central Scotland and remotely across the rest of the UK.
Identity and access management in EdinburghIdentity and access management in LeithIdentity and access management in FifeIdentity and access management in Livingston and West LothianIdentity and access management in GlasgowIdentity and access management in DundeeIdentity and access management in Aberdeen and the north eastIdentity and access management in StirlingIdentity and access management in FalkirkIdentity and access management in Perth and PerthshireIdentity and access management in LondonIdentity and access management in ManchesterIdentity and access management in BirminghamIdentity and access management in LeedsIdentity and access management in LiverpoolIdentity and access management in SheffieldIdentity and access management in BristolIdentity and access management in Newcastle upon TyneIdentity and access management in NottinghamIdentity and access management in LeicesterIdentity and access management in CoventryIdentity and access management in CardiffIdentity and access management in SwanseaIdentity and access management in BelfastIdentity and access management in SouthamptonIdentity and access management in BrightonIdentity and access management in ReadingIdentity and access management in Inverness
Related tech services
Cyber security audit
An honest, plain-English health check of how safe your business actually is, and a clear, prioritised list of what to fix first. The sensible first step before spending a penny on security.
AI audit
Find out what AI your staff are already using, what business data might be leaking into it, and whether any of it is safe, before it becomes a problem. Plain-English, no hype, no obligation.
VoIP and cloud telephony
Business phone systems that follow your team anywhere. Number porting, call routing, voicemail to email, and call recording where you need it.
Dialler systems
Predictive, progressive and preview diallers for outbound teams. Set up, tuned, and kept compliant with Ofcom rules on abandoned calls.
Transcription and call intelligence
Every call, meeting and voice note turned into searchable text, with summaries and actions extracted automatically. Accurate on strong regional accents.
Admin Rescue
Stop missing calls. Stop quoting at midnight.