The fix,not just the finding.
IT security consulting services for Danish mid-market companies on Microsoft 365: Entra ID, identity and access management, and resilience. Reviewed, prioritized, and implemented.
No pitch. No pressure. Just a conversation.
Ganc Consulting Clients
1
Talk for 30 minutes
No charge, no obligation. If it’s not worth doing, I’ll say so.
2
Scope in writing
What gets reviewed, what access is needed, what you get back.
3
Fast delivery
Receive prioritized roadmap or become a center of security excellence.
Ways to work together
Start narrow or go broad. Every engagement is scoped on the call.
Start here
Baseline
Security review against best practice.
- Analysis of your Entra ID configuration and federated apps
- Compliance check and validation by a senior security expert
- Findings ranked by risk, cost and effort to fix
- Hand-over walkthrough meeting and ad hoc follow-up meetings
- From DKK 19,500 excl. VAT, fixed price
Advanced
Fix the findings and use every license feature.
- Everything in Baseline
- Implementation of the low-friction controls from the Baseline findings
- Every Entra ID feature in your license assessed, plus external access in Teams, SharePoint and OneDrive
- Prioritized roadmap of initiatives incl. cost, benefit and time plan.
Pro
Every control implemented, plus governance.
- Everything in Advanced
- High-friction controls and features chosen from the roadmap
- Joiner, mover and leaver across your core systems, with a landscape map and decisions log
- Change management and training for the people affected
The Baseline price is confirmed after a free 30-minute scope call, before anything is collected.
Outside the box?
No worries, there are plenty of other services. Pick a track.
Everyone is using AI. Some have a policy. None have control.
Shadow AI is already inside your company: a browser extension, a personal ChatGPT account, an agent running with more access than anyone intended. Nobody knows what it can reach, what data it has been fed, or who answers for it when something breaks. If an agent does something it was never told not to do, who is responsible? That stops mattering once the damage is real.
Containment for the AI you already have, then an architecture that’s actually designed, not improvised.
The immediate task is containment: defining the boundaries and sanctioning the tools already in use. Once that’s in place, I design the AI architecture properly, so what gets built later doesn’t repeat the same mistakes. Every recommendation is validated by a certified consultant before it reaches you.
AI security and complianceLocal LLM vs. cloudHuman in the loopRAGModel and cost optimizationAI evaluationAI engineeringAI solution design
Everyone can reach more than they should. Nobody notices until an audit does. Or a hacker.
Your identities may sit across Entra ID, on-prem AD or stand-alone systems. You may also have a large shadow IT. When a client, auditor or manager wants to know who has access to systems or data the answer currently lives in six spreadsheets and one person’s head.
Access control that is automated, secured, and less expensive to run.
One authoritative view of who has access to what, with access that grants and revokes itself. This removes the manual admin burden and improves the security posture, license cost, and onboarding/off-boarding lead-time. When asked to prove least privilege, the answer is a report instead of a week of spreadsheet work.
Joiner-mover-leaverPIM and PAMAccess reviewsRole-based Access controlAudit evidenceApp onboardingOAuth2, OIDC, SAML, SCIM
Assume it already happened. Can you come back?
You have backups and you have a policy. What you probably do not have is a tested answer to which twenty applications come back first, in what order, and who is allowed to make that call at two in the morning.
A recovery order that is written down, agreed in advance, and has actually been tested.
You stop discovering during the incident which systems come back first and who is allowed to make that call. Scenarios are walked through with the people who own the systems, so the plan holds up on the night it is needed rather than on the day it was written.
Disaster recovery planTabletop / Full-scale exerciseBusiness impact assessmentSolution designBuild or buyRTO / RPORunbookISO 22301
Sometimes you need a pair of hands that has seen this before.
The work is scoped and the budget exists. What is missing is someone senior enough to make the calls and technical enough to build it without a handover meeting for every decision.
Senior capacity that designs the work and then builds it, without a handover meeting for every decision.
Architect-level judgement and hands-on delivery in one person, scoped by the week or the sprint. Nothing gets lost between whoever draws the design and whoever implements it, because they are the same person.
Security architectCISO advisoryDeveloperManagement ConsultantTechnical Project Manager
Brokers and procurement: CV and references can be requested. Excerpt of engagements are on the cases page.
“Artur was also working on a competitive vendor solution, but helped me in a very unbiassed way to put the customer need first … He was also confidently willing to challenge the customer when they needed leading to a better approach.”
“He communicates clearly and people trust him quickly, which really helped bring different teams together … I’d strongly recommend him for any security role.”
“I have employed Artur two times, and I have been very satisfied. He masters both strategy work … but also highly technical tasks.”
CISM and CEH certified · 10+ years in identity and access management