Is your company as secure as you think?
TenantWard is self-serve IT for growing companies. One guided platform for Microsoft 365 or Google Workspace, your email, domains and devices: see where you really stand, fix it with changes you can always undo, run it day to day, and prove it to anyone who asks.
Want the full picture? Connect Microsoft 365 or Google Workspace, read-only and free for 14 days.
northwind-dental.com
Example report58/100
Some real gaps: 3 to fix and 1 to review.
- CriticalNothing stops criminals sending email as this domain
- HighMicrosoft 365 isn't signing your email (DKIM)
- HighYour domain isn't locked against transfers
- MediumYour website's certificate expires in 12 days
6 checks passing
Everything it takes to run IT. One platform.
Most tools hand you a report and leave. TenantWard covers the whole job, and every part feeds the next: a fix raises your score, a change lands in the record, an alert opens the investigation. Do it yourself, or check the work of whoever you pay to.
Know
Where you really stand
- Security scoreMicrosoft 365 or Google Workspace, email and domain, graded in plain English
- Email and domainSPF, DKIM, DMARC, certificates, lookalike domains
- DevicesStale, unmanaged and non-compliant computers
- BaselinesCIS, HIPAA and FTC Safeguards, control by control
Fix
What matters, safely
- Guided fixesTested scripts with a plan, a backup and an undo
- RunbooksStep-by-step help for what can't be automated
- Remediation planEverything ranked by risk, owned and tracked
Run
Your tenant, day to day
- People and mailboxesStarters, leavers, passwords, MFA, shared mailboxes
- Licenses and groupsSee who has what, free what nobody uses
- Settings backupsSnapshots of key settings, compare and restore
- DNS recordsSoonGuided record changes with rollback
Watch
Around the clock
- 24/7 monitoringNew admins, risky inbox rules, unusual sign-ins
- Incident responseLock down a hijacked account in minutes, automatically if you choose
- Payment fraudProtection against fake invoices and bank changes
- InvestigationsTrace a suspicious mailbox, contain it in one click
Prove
To anyone who asks
- Insurance answersEvery Yes backed by live evidence
- Board reportsA quarterly summary owners actually read
- Change recordWho changed what, when, and how to undo it
- Audit queriesSoonPlain-English questions about your tenant
The same rails under every module
Every change, wherever it starts, goes through these six steps.
- 1See the plan
- 2Back up first
- 3Run a tested script
- 4Check it worked
- 5Undo any time
- 6On the record
Self-serve, never unsupervised.
You run the changes; TenantWard keeps them on rails. Each one is a tested script, graded by how disruptive it is, with the plan spelled out before you commit, your current settings saved before anything runs, and one click to put them back.
- Backed up first, every time
- If the backup fails, the change doesn't run.
- Warned in plain words
- Who's affected and what might stop working, before you press go.
- Staged when it matters
- New sign-in policies start in report-only mode, so you see who they would affect first.
- On rails, not improvised
- AI explains and drafts. It never writes or runs a change.
Turn on Microsoft security defaults
In Harbor & Pine Legal
What will change
Security defaults: Off → On. Everyone sets up Microsoft Authenticator within 14 days.
What might stop working
The office scanner that emails with just a password
Who’s affected
All 11 people in the organization
If you need to undo it
One click turns them back off, exactly as saved
Try it: tick the box and run the change.
Grace Lindqvist
grace.lindqvist@harborpine-legal.com
The admin console, in words you’d use.
Add a new starter, reset a password or MFA, hand a leaver’s mail to their manager, free a license. Each task is a short guided form with help on every screen, and every one goes through the same safe-change plan.
- Offboarding in one step: locked out, mail kept, license freed, all undoable
- Temporary passwords shown once and never stored
- A change history with who did what, and an undo button
Still watching at 3am.
Most small-business breaches start with one mailbox: a stolen password, a quiet inbox rule, an invoice that never arrives. TenantWard looks every 15 minutes and tells you in Teams or Slack while there’s still time to act.
Email-based attacks were behind 60% of the claims in Coalition’s 2025 cyber claims report.
- 24/7 monitoring
- New inbox rules that forward or hide mail, new admins, app approvals, new sign-in methods, and sign-ins from countries a person has never used.
- Payment fraud protection
- Nine controls against fake invoices, a finance team whose alerts come first, and a payment-change policy to adopt.
- Incident response, your way
- When an account looks hijacked, TenantWard blocks sign-in, ends every session and switches off the attacker's inbox rule. Automatically at 3am, or with one click from you. Restoring access is one click too.
- Investigate a mailbox
- Where it signed in from, what was set up, and which messages were opened from suspicious places. Contain it with one button.
- Backups of your settings
- Sign-in rules, user permissions, sharing and forwarding, saved before every change and on demand. Compare and restore.
Proof for anyone who asks.
Insurers, customers and auditors want evidence, not a yes on a form. TenantWard answers from live checks, flags what changed since you last sent it, and tracks your renewal date.
- Cyber insurance answers with evidence for every Yes
- CIS, HIPAA and FTC Safeguards baselines
- A written security plan (WISP) to start from
- A quarterly report the owner or board will actually read
Cyber insurance answers
Renewal in 48 days
- MFA required for all users to access email?YesEvery sign-in requires a second step, checked today
- Legacy sign-in methods blocked?YesOld protocols are blocked, checked today
- Email authentication (SPF, DKIM, DMARC) in place?PartlyDMARC is monitoring, not yet rejecting
- External auto-forwarding restricted?YesBlocked at the outbound policy
- Admin accounts limited and separate?No5 people have full admin control
A Yes only when every check behind it passes. Never rounded up.
Built for whoever answers for IT.
The owner, the IT lead, the provider you pay. Everyone works from the same picture, in words everyone understands.
Owners who run IT themselves
Too small for a full-time IT person, too big to wing it. Do the admin yourself, with a safety net under every change.
CEOs who want proof, not guesses
A score you can trust, answers for insurers and customers, and a clear view of whether IT is being done properly.
IT leads with a lean team
Baselines, drift alerts, safe changes and one report for the board, without checking every admin center by hand.
Companies with an IT provider
An independent view of what's configured and what isn't, in words you can share with your provider. No upsell.
IT providers and agencies
One console across clients, alerts in your Teams or Slack, and reports that show clients the work they can't see.
Every client, one console.
Each client’s domains, Microsoft 365 or Google Workspace roll into one score and one queue. Make safe changes across clients, send alerts to your own channels, and hand each client a report that shows the work.
- Per-client pricing from $19 a month
- Client switcher on every page
- Free domain checks for prospects
Posture score, all clients
77/ 100
Last 30 days
+9
Open issues
19
- Marked fixed, awaiting check
- 3
- Fixed this month
- 11
| Client | Score | 12 weeks | Open issues | Assets |
|---|---|---|---|---|
| Northwind Dental | 89 | 12 | 11 | |
| Harbor & Pine Legal | 52 | 234 | 12 | |
| Cascade Bike Co. | 94 | 1 | 1 | |
| Ridgeline Architects | 71 | 231 | 13 |
Admin access, handled like it matters.
Microsoft and Google list every permission before you approve. Changes run with your own sign-in, only when you approve them, and every one is on record.
How we handle access and dataWhat TenantWard does
- Reads settings, roles, app permissions and sign-in status
- Makes changes only from a catalog of tested scripts
- Backs up settings before every change
- Records who approved what, and when
What it never does
- Read the contents of email, files or chats
- Store passwords or sign-in tokens
- Change anything you haven't approved
- Let AI write or run a change
One price per company.
The checkup is free, for good. Every new workspace gets 14 days of everything with no card, then keeps the free plan unless you choose otherwise.
Free
Where do we stand?
$0forever
- One domain, checked whenever you ask
- Your email and domain security score
- Every issue ranked, with why it matters
- 14 days of everything when you sign up
Manage
Can I run IT myself?
$33/ month per company
$390 billed yearly
- Step-by-step fixes, DNS records and scripts for every issue
- One-click fixes for routine and careful changes, backed up with undo
- One-click DNS fixes when your DNS is connected
- Admin center: people, mailboxes, licenses, groups
- Unlimited domains, Microsoft 365 and Google Workspace connections, daily rechecks
- License savings in dollars
Protect
RecommendedWill we catch it in time?
$83/ month per company
$990 billed yearly
- Everything in Manage
- One-click fixes for disruptive changes: sign-in policies, SPF, DMARC enforcement
- 24/7 monitoring with Teams and Slack alerts
- Incident response: lock down a hijacked account, automatically if you choose
- Payment fraud protection and mailbox investigation
- Configuration backups you can compare and restore
Comply
Can we prove it?
$166/ month per company
$1990 billed yearly
- Everything in Protect
- Insurance answers with evidence and renewal tracking
- CIS, HIPAA and FTC Safeguards baselines
- Written security plan (WISP)
- Quarterly board report and evidence export
- Priority human support
Flat price per company, not per person. Every new workspace gets 14 days of everything with no card; afterwards it stays on Free unless you choose a plan.
For IT providers and agencies
One console for every client, priced per client so it fits inside what you already charge.
- Every client gets the full Protect feature set
- Comply baselines +$10 per client
- Unlimited domain checks for prospects
- Your own tenant free
- Month to month, 5-client minimum
| Clients | Per client, per month |
|---|---|
| 1–10 clients | $19 |
| 11–50 clients | $15 |
| 51+ clients | $12 |
Minimum $95/month. A client with more than 50 people counts as two.
Start as a partnerQuestions people ask first.
Find out where you really stand.
Start with your domain: ten seconds, nothing to install, no account. When you’re ready, connect Microsoft 365 or Google Workspace and the whole platform opens up.