Improving Microsoft Secure Score – A Phased Security Uplift for a Global Cosmetics Company
Background & Challenge
This global cosmetics company had already been working with Astec for some time, having adopted Microsoft 365 and Azure services across its operations. However, with growth came complexity—and their Microsoft Secure Score was sitting at 54%, leaving the business open to potential risk and missing out on core security improvements available within the Microsoft ecosystem.
The benchmark for similar organisations was around 50%, meaning they weren’t far off the average—but there was a clear opportunity to do more and unlock measurable improvements to their security posture.
Initial Assessment
Astec carried out a focused security review centred around Microsoft Secure Score:
- Secure Score Audit: We reviewed all open recommendations and risk indicators within the organisation’s Microsoft 365 Secure Score dashboard.
- Gap & Impact Analysis: Each recommendation was reviewed for business relevance, risk reduction potential, and whether it would impact end users.
- Stakeholder Input: We worked closely with internal leads to understand operational dependencies and secure buy-in before planning out changes.
Design & Configuration
Based on the audit, Astec developed a 12 month security improvement plan:
- Phased Implementation Approach: To avoid disruption, Secure Score improvements were grouped and rolled out monthly—focusing on quick wins early on, followed by more impactful changes later in the programme.
- User-Aware Planning: Any changes likely to affect the user experience—such as new prompts or updated login methods—were reviewed and approved by key stakeholders in advance.
- Adoption of Microsoft Security Tools: As part of our planning, we identified that several Secure Score recommendations would also lead to the adoption of Microsoft security tools, including:
- Microsoft Defender for Endpoint
- Defender for Office 365 (Email Threat Protection)
- Attack Simulation Training
- Self-Service Password Reset (SSPR)
These tools were planned to be delivered as improvements beyond Secure Score, further strengthening the organisation’s cyber resilience.
Pilot Testing
Before major changes were rolled out across the estate:
- High-impact controls were tested in small user groups to test functionality.
- Feedback was collected to fine-tune implementation steps before wider deployment.
Internal Communications & Onboarding Resources
Astec supported the organisation in managing expectations and adoption:
- Any end-user impacting changes were communicated in advance through internal stakeholders as well as notifications from Astec to all users.
- Supporting guides and explanations were shared as needed to ensure a smooth rollout.
Deployment & User Support
With the plan agreed and tested, we began rolling out changes:
- Monthly Implementation Cycles: Secure Score actions were implemented in logical batches—balancing progress with operational stability.
- Configuration Updates: Conditional access, threat protection policies, and identity-related configurations were applied in line with the recommendations.
- User Support: For any changes that affected the end-user experience—such as new prompts, login behaviour, or interface changes—Astec remained on hand to provide clarity, guidance, and reassurance. This ensured that users were supported during visible changes, without unnecessary disruption to day-to-day work.
Validation & Reporting
At the end of each month, Astec delivered a clear report to track and validate progress:
- Secure Score movement and updated posture
- Actions completed that month
- What remained and upcoming priorities
- Summary of user impact and improvements delivered
Outcome
- Secure Score increased from 54% to 94%, placing the organisation well above Microsoft’s benchmark for similar businesses.
- Rapid Progress: By month three, the business had already reached 86%, with further improvements following.
- Improved Security Through Adoption of Microsoft Defender, Email Threat Protection, SSPR, and Simulation Training.
- Operational Gains from SSPR: Password resets were no longer reliant on IT, reducing ticket volumes and enhancing security by removing the need for shared or manually set credentials.
- Minimal Disruption: All changes were planned with operational continuity in mind.
- Collaborative, Structured, Personal: The programme was delivered in partnership with the client—flexible, transparent, and always aligned to their business priorities.
“We knew we had a decent foundation in place, but Astec helped us take things to the next level—without overwhelming the business or the team.”
