Alan
Co-founder
To do
About us
Two people. One narrow surface. Deliberately.
Subtle Cyber exists because Microsoft identity configuration has become too large for anyone to hold in their head, and too consequential to leave unexamined. We are small on purpose and this page explains why that is a feature rather than an apology.
Why this exists
The gap we kept finding.
Microsoft Entra ID is where access decisions actually get made now, and its configuration surface has grown faster than anyone's ability to review it. Conditional Access policies interact in ways that are only visible when you read all of them together. Privileged role assignments accumulate through reorganisations. Groups get created to solve one problem and quietly become the way around another.
Every organisation we talked to had the same experience: a licensing review, a migration, or an audit would surface something that had been true for years and that the existing tooling had never mentioned. Not because the tool was broken, but because the question was about relationships between settings rather than any single setting.
So we built a tool to read the whole surface every time, and made the company small enough that the person who built it is the person doing your assessment. That is the whole origin story. There is no methodology to trademark and no framework with our name on it.
Who you're dealing with
Alan and Ross.
Both principals work on every engagement. Whoever you email is whoever reads your tenant, which is the main practical difference between us and a firm that assigns you a delivery manager.
Ross
Co-founder
To do
Our stance
Four positions we'll defend.
These are the opinions that make our reports read differently from other people's, and they are all arguable, which is the point.
Read-only should be provable
If a vendor says read-only and you cannot verify it from your own sign-in logs, that is a claim, not a control. We build so that the claim is checkable, and we would rather a client check it than take it on faith.
Volume is the failure mode
A register of four hundred findings is not thoroughness, it is deflection. The deliverable's value is the ordering and the editing, and the tooling's job is to make that editing defensible rather than to produce more rows.
Tools should report their own blindness
A tool that cannot tell you what it failed to see is worse than no tool, because it manufactures false assurance at scale. Warden's Limitations section is not a disclaimer appended to the report; it is part of the assessment.
Small is a working choice
Growth would mean hiring people to run a tool we designed, then managing them, then selling capacity to justify their salaries. We would rather stay at the size where the person who answers your email is the person who can fix the thing you found.
Practical details
The administrative facts.
- Company
- Subtle Cyber Ltd. Companies House number and registered office to be added before launch — they belong in the footer and on quotations, and we have not published a guess.
- Focus
- Microsoft Entra ID configuration assurance. Not endpoint, not email security, not managed detection.
- Engagement model
- Fixed-scope assessments and short investigations. No retainers, no minimum term, no auto-renewal.
- Independence
- We are an independent company. Microsoft, Microsoft Entra and Microsoft Graph are trademarks of the Microsoft group of companies, and we hold no Microsoft partnership designation. We read Microsoft Graph using standard permissions and no private interfaces.
- Data handling
- Tenant exports are treated as client confidential, written with owner-only file permissions, stored outside the code repository, and deleted at engagement close with confirmation. Where they may live is agreed per engagement before the first collection.
- This website
- Static, no cookies, no analytics, no third-party scripts or fonts. Everything is served from this domain. Nothing about you is collected by visiting it.
Questions about us are the good kind.
Ask who will actually do the work, ask what happens if you disagree with a finding, ask which checks are built today. If we cannot answer specifically, that is your answer about us.