Does InteliSense manage our security?

Not by default. You own your identity architecture, your security policy and your data. We work within your approved Microsoft security model and take the specific delivery or support responsibilities agreed in scope.

Are you a cyber-security provider?

No. Security is built into how we design and operate business applications, and it is not a replacement for your wider cyber-security capability. We do not provide a security operations centre, managed detection and response, endpoint or network security, threat hunting, forensic incident response, penetration testing or red teaming.

Who is actually responsible for security in Dynamics 365?

It is shared, and every boundary needs an owner. Microsoft operates the underlying cloud services. You retain responsibility for users, business policy, access decisions and data. Our part depends on the agreed implementation, support or managed-service scope. ISVs, CSP, identity and integration suppliers remain responsible for their own services. We make those boundaries explicit rather than leaving them assumed.

How do you handle segregation of duties?

By looking at what someone can do in combination rather than permission by permission. Create a supplier, change bank details and approve the payment is the classic example, and there are others specific to your processes. The principles are consistent across platforms, though the mechanisms differ. We do not claim to run automated segregation-of-duties tooling.

What about AI and agents reaching business data?

An agent is an actor and gets the same questions as a person: what may it see, what may it do, on whose permissions, what is logged, and what happens when it fails. Approved actions and approved context, with a human in the loop where the consequence justifies it, rather than unrestricted access to the back end.

Security, governance and trust

Who can see it,
who can change it,
and who signed that off?

Most security problems in business applications are not clever attacks. They are wide roles granted to get live, leavers who kept their access, and a service account nobody owns. The work is unglamorous and it is what makes an audit, an integration or an AI rollout survivable.

See how we approach it

Identity. Access. Data. Change. Audit. Reviewed again in six months.

Sound familiar?

Access rarely gets wide on purpose.

These are the things IT, finance and risk leaders describe before a governance review starts.

Nobody can tell the auditor who can approve a payment
The permissions exist somewhere. Explaining them in a meeting is the hard part.
Everybody got the wide role to get live
It was temporary in the plan and permanent in production.
A flow is owned by somebody who left
It still runs every night, on their account, and nobody wants to be the one to touch it.
Leavers still have access
The starter process works. The leaver process depends on somebody remembering.
Nobody knows what the integration account can do
It was set up years ago with whatever permissions made the job work.
Someone wants to switch AI on
The question nobody has answered is what it would be allowed to see and do.

How we approach it

Six things that keep a platform defensible.

Security is not one control. It is a chain of decisions that has to stay connected.

Stage 1 of 6

Agree what actually needs protecting

What we do

Which processes, which data and which actions carry real consequence. Everything else can be simpler.

Test who cannot do something. That is the test that matters.

What customers say

People who have been through it.

Around 80% of our business comes from existing customers and referrals. These are their words, not ours.

80%

of our business comes from existing customers and referrals.

All customer stories

The best I’ve ever experienced in over 20 years of collaboration.
Programme Manager, Hill & Smith Plc

Four decisions

What you are approving, and when.

Four points where the control model has to justify itself, in language a board or an auditor can follow.

Gate 1Before the design

What actually needs protecting?

Control designed without context produces either too much friction or too much access. This is where that is settled.

Confirmed at this gate

Which processes and data really carry consequence
Who acts, including external parties, integrations and AI
Regulatory or customer obligations you have to meet
A named owner for security risk on this programme

Decision

Proceed
Get more information
Rescope

Gate 2Before it is built

Does the model hold together?

Controls can all be present and still leave a gap. An exception recorded here is a decision, not a failure.

Confirmed at this gate

Identity, roles and the combinations nobody should hold
Environments, data and external access
Integration identities and how credentials are managed
What AI and automation are allowed to do

Decision

Approved
Remediate
Exception recorded

Gate 4Six months later

Is it still true?

Security posture decays quietly. Confidence should come from evidence, not from the fact a checklist was completed once.

Confirmed at this gate

Joiners, movers and leavers actually working
Access and privileged access reviewed as agreed
Non-human identities still owned, credentials still valid
Exceptions revisited rather than forgotten

Decision

Operate
Remediate
Optimise
Recover

Swipe, drag or use the arrow keys to move between decisions.

Check the fit

A few questions before a governance conversation.

A routing aid rather than an assessment. Your answers come with you into the conversation, so nothing has to be repeated.

Question 1 of 4

0 of 4 answered

1. Why are you here?

Organisational level only. Do not enter credentials, access tokens, personal information or vulnerability detail.

Please do not send passwords, credentials, access tokens, personal information or details of a suspected vulnerability through this form. Tell us the topic only and we will agree a suitable route. A published secure vulnerability-reporting channel is not yet available, so please ask for one without describing the issue itself.

Common questions

Questions leaders ask about security and governance.

Part of the InteliSense Delivery System

Security sits inside how we deliver, not beside it.

Role design, environment control, integration identity and AI boundaries are decided as part of delivery, at the gates where they can still be changed cheaply. Our delivery approach shows where each of those decisions lands.

How we deliver

A conversation, not a pitch

What would you struggle to explain to an auditor?

The wide role, the account nobody owns, or the AI question you have been asked to answer by next month. Start there and we will tell you what we would look at first.

Looking for our wider ESG position? See environmental, social and governance

Please do not send passwords, credentials, access tokens, personal information or details of a suspected vulnerability through this form. Tell us the topic only and we will agree a suitable route. A published secure vulnerability-reporting channel is not yet available, so please ask for one without describing the issue itself.

Who can see it,
who can change it,
and who signed that off?

Access rarely gets wide on purpose.

Nobody can tell the auditor who can approve a payment

Everybody got the wide role to get live

A flow is owned by somebody who left

Leavers still have access

Nobody knows what the integration account can do

Someone wants to switch AI on