&Secure is a security posture management app for Google Workspace and Microsoft 365 administrators. After an administrator signs in with Google and connects their organization, &Secure reviews the organization's security settings, administrator accounts, sign-in protections and third-party app access against the CIS and CISA SCuBA benchmarks, shows what is misconfigured and how to fix it, and re-checks every day.
&Secure requests access to Google Workspace administrative data—users, groups, admin roles, audit reports, connected apps and policy settings—only to assess and improve your organization's security. It never reads the content of email, Drive files, chats or calendars, never sells data or uses it for advertising, and follows the Google API Services User Data Policy, including its Limited Use requirements. Details are in our Privacy Policy.
309 controls from CIS, CISA SCuBA and Google's checklist—207 checked automatically, every day, with the fix for each one.
Learn more →78 CIS Microsoft 365 controls across Entra ID, Conditional Access and Exchange Online. Mixed estate? One score, one bill.
Learn more →Realistic simulations over email, text and voice—the channels real intrusions use. Every one ends by teaching, and nothing typed is ever stored.
Learn more →44 short video modules—including a full AI-literacy track—with quizzes, graded tests and a certificate people can prove.
Learn more →Real findings, in the words the product uses—each with the evidence behind it and the exact fix.
Authorize &Secure as a Google Workspace administrator and we inventory your users, admins, OAuth apps, and security settings—then score every category against the frameworks that matter.
Start the free scan3 administrators are missing 2-Step Verification, and an OAuth app holds broad Drive access. Here's the exact change for each—approve and we'll apply it, then verify on the next scan.
&Secure starts read-only. Turn on remediation and safe fixes become one click: we show the exact change, you approve it, we apply it and re-verify—every action attributed and logged. Nothing in your environment changes without your sign-off.
Want a person to walk it with you? A security review ranks what to fix first, what's noise at your size, and what to tell your insurer.
You can pass every control and still lose a mailbox to someone who typed their password into a convincing page. So the same product tests your team and trains whoever needs it—on the same directory, with no second vendor and no list to keep in sync.
Email, text or voice—from a library of 7 scenarios or your own.
Everyone who engages is shown what gave it away. No shaming, no league table.
Whoever submits credentials is auto-enrolled in the module that teaches exactly that.
Graded tests and an exam at 80%, issuing a certificate anyone can verify.
The controls we check are crosswalked onto the frameworks your customers and auditors ask about, so one fix credits in several places. Export a printable evidence pack per framework, or the full CSV.
These are informative crosswalks, not certification—we say so in the export too.
How the mapping works →Every client's tenant under one account, a fleet view ranked worst-first, branded reports with your logo, and one consolidated bill at partner rates.
See the partner offering →You connect as an administrator and we request read-only scopes to inventory users, admins, apps and settings. We never request or read mailbox or document content. Remediation is off by default; turning it on requests write access only for a small set of safe controls, and every change still needs your explicit approval.
About ten minutes. Authorise the connection and the first scan starts immediately; you'll have a score and a findings list while you're still in the tab. After that it rescans daily on its own.
Not unless you approve it. &Secure starts read-only. Even with remediation enabled, we show you the exact change and apply it only after you approve—then re-verify on the next scan, with the action logged and attributed.
It gives you your real score and the per-framework pass/gap counts from a genuine scan of your own tenant. What it doesn't show is the detail—which specific controls are failing, the evidence, and the fixes. That's the paid product.
No—it's one product at one price, so you get both regardless. Most people start with the scan because it's immediate, then turn on simulations and training once the configuration work is under control.
Both are supported as first-class platforms, and a mixed estate runs in one account with one score and one bill. See the Microsoft 365 page for exactly which controls are covered.
No feature tiers and no add-ons—everyone gets the whole product. $49/mo for up to 5 users, then per additional user from $5 down to $2 as you grow.
See pricing & estimate →