Measurement

You can’t improve what you can’t measure.

Every other discipline earned its numbers decades ago. Security still runs on adjectives, gut feel and vendor black boxes. 1Security turns your live Microsoft 365 tenant into measured, trended, benchmarkable intelligence - where every deviation is recorded, every trend has a baseline, and every threshold belongs to you.

Measure your tenantLive demo
First numbers the day you connect

From black box to clarity

The dial is yours - and history answers instantly.

Anomaly detection is normally a black box: a threshold somebody else picked, invisible, immovable - and everything below it silently discarded. You can never tell whether quiet means safe or means the dial cut off exactly the thing that mattered.

1Security splits that decision. What is unusual is measured and always recorded, down to the smallest meaningful deviation. What deserves an alert is a line you set - and when you move it, your existing history re-classifies in place. You see what a stricter or looser setting would have caught, on your own real activity, with no tuning period and no quarter of waiting.

What gets measured

Everything that moves in the tenant, on a scale.

Not samples, not surveys - measured activity across every resource type, cut both ways: the extremes and the dormant.

  • Pre-defined

    suggested trends, counted live

    Permission creep, oversharing velocity, exposure direction - each template shows how many resources match in your tenant before you enable it.

  • Every type

    ranked activity cuts

    Top downloaders, unused agents, dormant licensed users, quiet sites - across users, files, sites, groups, emails, apps, agents and devices.

  • 1h → all-time

    windows that fit the question

    Sub-day windows evaluated from raw activity catch a mass download while it unfolds; long windows answer instantly from rollups.

The numbers that run the program

Direction of travel, not a snapshot.

A point-in-time report is obsolete when it renders. These are living series - trending, comparable, exportable.

  • Exposure
    is it shrinking or growing, per quarter
  • TTD / TTR
    time-to-detect and time-to-remediate, tracked
  • Waste
    licenses, apps and storage, ranked by cost
  • Adoption
    Copilot, agents and sites - used or abandoned

Shared, not siloed

Boards you arrange, links you can send.

Ranked, sparklined, exportable - arranged into boards per team, with shared views for the whole tenant and every filtered cut carried in a URL a colleague can open.

Measurement that acts

Act on what you measure.

  1. 01

    Any measurement becomes an alert in one click

    Threshold or deviation-from-own-baseline - the default needs no number from you, and instant or digest delivery is your choice.

  2. 02

    Any finding carries its fix

    The measured pile of oversharing or waste connects straight to automations - counted, staged and reviewed before anything changes.

  3. 03

    Every improvement stays proven

    The same series that found the problem shows it shrinking - evidence for the next audit, the next budget, the next board meeting.

Put a number on it.

Connect read-only and watch the first baselines build from your own activity - measured, not estimated.

Book a demoLive demo
No thanks - gut feel has been fine so far.