Kyvoi
I have spent over eleven years in Microsoft 365 and identity security — consulting, solutions architecture, and the unglamorous work of actually securing tenants. My customers have been banks and financial services firms, insurers, manufacturers, healthcare providers and energy companies, in India and across the world.
The same thing happened on almost every engagement. An audit would be coming, or a customer security questionnaire would arrive, and a team of capable people would disappear for weeks. Not solving security problems. Gathering evidence about them.
Someone would open the Microsoft Entra admin centre, then Microsoft Purview, then Defender, then the Exchange admin centre, then Intune. Screenshot a setting. Work out which clause of SOC 2 or ISO 27001 it answered. Write a justification. Repeat, ninety times over. By the time the document was finished, something in the tenant had already changed.
Two things about that always bothered me.
The first was the cost. A manual Microsoft 365 security gap analysis is a consulting engagement. It takes days of senior time, it is priced accordingly, and it produces a document that is out of date on the day it is delivered. Large enterprises absorb that. A two-hundred-person company cannot, so it goes without — not because its risk is smaller, but because the assessment is priced for someone else. The organisations that most needed to know where they stood were the ones least able to find out.
The second was the misunderstanding. Controls are routinely assumed to be in place when they are not. A tenant has a Conditional Access policy, so people believe MFA is enforced — but the policy excludes a group somebody added two years ago. Defender for Cloud Apps is licensed, so it is assumed to be working — but no policy was ever configured. Audit logging is believed to be on because nobody turned it off, when in fact it was never turned on. A licence is not a control, and a policy that exists is not a policy that applies.
Almost none of this work required judgement. Reading a tenant's configuration is mechanical. Knowing which clause of which framework a setting answers is knowledge that can be written down once. The judgement — the business context, the compensating controls, the decision about what to fix first — is the part a person should spend their time on. The weeks of screenshots were never that part.
So I built Kyvoi. It is the engagement I ran by hand for over a decade, automated: the same controls, the same clause-by-clause mapping, in minutes rather than weeks, at a price a mid-sized organisation can approve without a business case.
Security knowledge should not only be available to organisations that can afford consultants. That is the whole intent behind Kyvoi.
Kyvoi connects to a Microsoft 365 tenant with read-only permissions and evaluates 93 security controls across seven areas: identity and access, email security, devices and endpoints, data protection, threat detection, workload identities, and tenant configuration. A scan takes two to five minutes. Nothing is installed, and no agent is deployed.
Every finding carries the configuration value actually observed in the tenant — not an inference, and not a score derived from something adjacent. Alongside it: the compliance clauses the finding affects, the remediation step, a direct link to the Microsoft admin page that resolves it, an estimated time to fix, and the MITRE ATT&CK technique it maps to.
The report maps clause by clause to 17 compliance frameworks: SOC 2 Type II, ISO/IEC 27001:2022, NIST SP 800-53, NIST CSF 2.0, PCI DSS v4.0.1, the HIPAA Security Rule, GDPR, CIS Controls, CMMC 2.0, APRA CPS 234, NZISM and the ASD Essential Eight — together with the Indian frameworks most comparable tooling leaves out entirely: the Digital Personal Data Protection Act 2023, CERT-In Directions, RBI Directions and SEBI CSCRF 2024.
Compliance frameworks are one lens on the same data. Kyvoi works equally well as a straightforward security gap analysis: what is misconfigured in identity, in email, on devices, in Purview, among your service principals and app registrations — and which single change closes the most gaps across the most frameworks.
Small organisations get an assessment they could not otherwise justify. Mid-sized organisations get audit evidence without pulling a team off their work for a fortnight. Enterprises get continuous coverage of a tenant that changes constantly. And managed service providers and consultancies get the clause-mapping work automated, so consultant time moves to the judgement that cannot be automated.
A control that passes today can silently regress tomorrow. Kyvoi Continuous Monitoring re-checks on a schedule you choose and alerts your team in Microsoft Teams the moment a control regresses, naming what changed, the severity, the compliance clauses affected, and a link to the fix. It keeps a history of every control over time — which turns "prove this control held through the audit period" from an unanswerable question into an answerable one.
Kyvoi changes nothing in your tenant and never reads the contents of your email, files or messages — only configuration. Only a Global Administrator can approve the connection, on Microsoft's own consent screen where every permission is listed before approval. Nothing is installed, and you can revoke access yourself from your Entra portal at any time without contacting us. See exactly what it can and cannot access →
Coverage depends on your licensing and on what Microsoft exposes through its APIs. Some settings have no API at all. Where a control cannot be assessed, the report names it and gives the reason, rather than quietly scoring it as a pass to make the number look better. A report that overstates your position is worse than no report, because you act on it.
Every finding prints the configuration value read from your tenant. If Kyvoi says unified audit logging is disabled, the report shows UnifiedAuditLogIngestionEnabled: false. An auditor can work with that. Nobody can work with a score alone.
Kyvoi is early, and we would rather say so than pretend otherwise. Both products are published on the Microsoft Marketplace and transact through Microsoft's own billing. If you are evaluating Kyvoi and want to speak to the person who built it, that person answers support directly.