Azure security for mid-sized and industrial companies

Network security groups filter on IP addresses, ports and protocols, and for separating subnets they are often enough. They reach their limit as soon as you want to restrict outbound traffic by destination name, log it centrally, or enforce the same rules consistently across several spokes. That is where Azure Firewall comes in: it sits in the hub, sees the traffic of every attached network and allows rules at application level. In practice we use both together, not one instead of the other. Which combination makes sense for you depends on how many spokes you run and what evidence you have to produce about your traffic.

That depends mainly on the size of the subscription, the number of applications and how well the current state is documented. A single application with a clear architecture is reviewed far faster than an environment that has grown over years across several tenants with unclear ownership. So we fix the scope before we start instead of quoting a flat figure that will not hold. In the first conversation we clarify what should be reviewed, and you get a reliable timeframe for exactly that scope.

The price follows the scope: how many systems and interfaces are tested, whether we test from the outside only or additionally with a regular user account, and whether a retest after remediation is included. A single web application sits well below a review of several connected systems with their own role model. We deliberately do not publish a list price, because without a scope it would say nothing. The useful order is the other way round: first settle what has to be tested, then the effort that follows from it. That is part of the first conversation and costs you nothing.

Yes. Zero Trust is primarily a question of configuration rather than team size: Conditional Access, role-based access control and Privileged Identity Management are built into Microsoft Entra ID. The effort sits in designing the rules and rolling them out without stopping day-to-day operations. We take that part on, your team gets the rules explained and maintains them afterwards. If you would rather not cover ongoing operations yourself, they can be handed over to our managed service.

Your IT department stays accountable, we work alongside it. In practice that means joint reviews, changes through your existing processes and approvals, and documentation where your team already looks for it. We do not stand up a second toolchain next to yours, we work in yours. Where knowledge is missing we train it in rather than building a dependency. The goal is that your team can run the environment without us once the project ends.