Proof, not promises.
Three engagements that show what identity-first security looks like in practice. We don't name names. Our clients prefer their security not to be in the paper.
Phishing-resistant MFA for an international chemicals enterprise
Situation
Sites in several countries and production locations that can't stand still. MFA was in place, but on methods a good phishing page can bypass. One intercepted session was enough to get in.
What we did
An authentication architecture based on FIDO2: passkeys and hardware keys, with Conditional Access enforcing the method per group and per risk. First a proof of concept with a limited group, then a phased rollout per country, with instructions for local IT and a fallback for anyone who loses a key.
Result
A stolen password or intercepted code opens nothing anymore. The rollout didn't touch production, and the organisation now has one authentication policy across all countries.
Passwordless for organisations across sectors
Situation
Organisations from a range of sectors with the same problem: passwords reused, forgotten and phished, and a helpdesk spending a lot of time on it. Where shared workstations are used, staff also need to sign in fast.
What we did
A passwordless design on Entra ID per organisation: passkeys and Windows Hello for Business for personal devices, a fitting method for shared workstations, and Conditional Access deciding who goes where. Rolled out in waves, with plain-language communication to staff.
Result
There is no password left to phish or forget. Sign-in is faster, and the security level is demonstrably higher for auditor and board.
Full Zero Trust transformation at multiple organisations
Situation
Organisations in healthcare, manufacturing and the public sector, among others, still working from a trusted internal network, each with its own framework such as NEN 7510, ISO 27001 or the Dutch government baseline, and staff increasingly working outside the walls. Access was based on where you are, not who you are.
What we did
For each organisation, identity, device, data and access redesigned on the Microsoft platform. Entra ID as the central identity, Intune for device management, Conditional Access that explicitly evaluates every access, and data protection matched to the sensitivity of the information, from patient records to production data. Each design is documented in a way that operations and auditor can follow.
Result
Staff work securely anywhere, regardless of network. Access is based on identity and device state, and each organisation can show how it works at an audit against its own framework.
Example engagements
The engagements below are composites of our work at comparable organisations and are shown for illustration. They show how an engagement unfolds, from the starting situation to what it delivers.
Identity governance at a university of applied sciences
Situation
Thousands of accounts for students, lecturers, researchers and temporary staff, spread across faculties that arranged access themselves. Permissions kept accumulating, former employees were still in systems, and every audit meant starting the search all over again.
What we did
We rebuilt the joiner-mover-leaver process in Entra ID, connected to the source systems for staff and students. Roles per function instead of per person, access reviews per faculty, and permissions that expire unless someone deliberately extends them. Administrative rights only just-in-time.
Result
Accounts now leave together with the employee. Permanent administrator accounts have largely disappeared, and the question "who has access to what" is answered with a report instead of a search.
Shared workstations on the production floor
Situation
A manufacturer where shifts worked with shared accounts: one login per workstation, the password on a note next to the machine. Actions could not be traced back to a person, and the usual MFA methods did not work with gloves on.
What we did
Passwordless on the floor using badges and FIDO2 keys, making sign-in faster than the old password. Conditional Access treating the production environment separately: managed devices, fixed locations, short sessions. Administrative access to the systems behind it only temporary and on request.
Result
Every action is traceable to a person, without slowing down operations. The password note is gone and the OT environment is separated from office identities.
Baseline and Cybersecurity Act at a public sector organisation
Situation
The measures were largely in place, the evidence was not. Every assessment took weeks to demonstrate what was already running, and nobody could say with certainty whether new obligations had been assigned.
What we did
Risk analysis and measures linked to the standard, so that every measure has an owner and a piece of evidence. Detection and response built on identity and cloud signals, and a quarterly cycle in which the evidence emerges as a by-product instead of being gathered afterwards.
Result
At the first assessment the documentation was ready. The organisation now knows who is responsible for each measure, and the board receives a quarterly picture based on facts rather than assumptions.
An engagement like this for your organisation?
Each of these started with a Digital Defense Review. After that we both knew what had to happen and in which order.
Or call +31 (0)85 303 46 43