Secure Scores

What is Microsoft Secure Score?

Microsoft Secure Score is a numerical representation of an organisation's security posture across Microsoft 365. It measures how many recommended security controls have been implemented, from multi-factor authentication and conditional access policies to data loss prevention and device compliance. A higher score means a more hardened environment.

The industry baseline shown here is the global average score for organisations of similar size and sector. Most organisations score between 30% and 50%. Our portfolio consistently scores above 75%, because every Tarbh Tech client receives the same security baseline during onboarding.

We publish these numbers openly because we believe transparency builds trust. If an MSP won't show you their security outcomes, ask yourself why. These are live numbers, updated daily, drawn directly from our managed tenant portfolio.

Not every security control is appropriate for every environment. Actual scores reflect the controls that can be safely enabled given each client's business requirements, legacy systems, and risk appetite. The 75% target represents our engineering standard; individual results may vary.

Why we standardise

Standardisation enables predictable security outcomes. When every client starts from the same baseline, we can publish our metrics with confidence, because the methodology is consistent, tested, and repeatable.

It also means your team gets the same level of protection as every other Tarbh Tech client, from day one. No corners cut, no “we’ll get to that later.” The baseline is the starting line, not the finish.

The standards landscape

There’s no shortage of security frameworks. Microsoft’s own Secure Score provides a useful starting point. NIST offers broad cybersecurity guidance. ISO 27001 covers organisational information security management. But when it comes to the specific hardening of Microsoft 365 environments, one framework stands above the rest.

Why CIS is the gold standard

The CIS Microsoft 365 Foundations Benchmark is maintained by the Center for Internet Security, an independent, non-profit organisation trusted by governments, enterprises, and managed service providers worldwide. Unlike vendor-provided recommendations, CIS benchmarks are consensus-driven, peer-reviewed, and prescriptive. They tell you exactly what to configure and why.

CIS benchmarks are also the basis of compliance requirements across multiple regulatory frameworks. When an auditor asks how your Microsoft 365 environment is hardened, a CIS-aligned posture is the answer they’re looking for.

Standards need context

Implementing CIS isn’t a switch you flip. The benchmark contains hundreds of recommendations, and not every control is appropriate for every organisation. A 15-person professional services firm has different operational realities to a 200-person manufacturer with factory floor devices.

That’s why we treat the CIS benchmark as our north star, not a rigid checklist. During onboarding, we assess each recommendation against your business context: your workflows, your users, your risk profile. Some controls are non-negotiable. Others need to be adapted, phased in, or deferred until the right infrastructure is in place. The result is a hardened environment that’s both secure and practical for the people who use it every day.