In development

The security you're already selling, made provable.

Armada scores each client's Microsoft 365 tenant, signs the result, and gives you a report with your brand on it. Raw scan data is discarded when the scan ends.

Request early access Tour the console

console.armada-solutions.com

Client fleet · sample data

ClientPostureFindings mixStatus

Cedar Ridge Accounting
Accounting · 17 seats910 H1 M14 okSecure

Vance Realty
Real estate · 22 seats741 H3 M8 okNeeds work

Brookline Dental Group
Dental · 31 seats622 H4 M9 okNeeds work

Harbor Law LLP
Legal · 29 seats483 H5 M5 okAt risk

Posture attestation

standby

Ephemeral scan · demonstration

identity · mfa registration·····

conditional access policies·····

privileged role assignments·····

raw telemetry in memory 0 bytes

sig awaiting scan

utc ·····

Only the signed result is kept. Anyone can check it.

Controls verified today

seven from Microsoft Graph · one from public DNS

Weighted controls

four of them are knockouts

Bytes retained per scan

discarded after scoring

Signed record per scan

hash-chained to the scan before it

Your security work is invisible until something breaks.

You harden tenants, chase the last few people who never finished MFA, and cut admin rights back down. Your client sees a line on an invoice, and at renewal that line gets questioned first.

The screenshot era

With Armada

You screenshot a scanner the night before the QBR, one client at a time.

Every client is scored on a schedule, so the report is current when you sit down.

The work lives in your head. Your client has to take your word for it.

Your client gets a written assessment under your name every month.

Settings drift after onboarding and nobody notices until an incident.

Every result is signed and chained to the last one. Drift alerts will compare those records. They aren't built yet.

Another vendor piles up your clients' security data, and your liability with it.

Armada discards raw data at the end of each scan, so there is none to breach.

How it works.

Connect your book

Armada uses the delegated admin access you already have, with three read-only Graph permissions we publish up front. Nothing is installed in your client's tenant, and they can revoke access from their own portal at any time.

Score and report

Every tenant is scored against the same weighted catalog. The catalog version is stamped on each result, so a March report still means the same thing in November. Drift alerts are designed but not built yet.

Defend the line item

Your client gets a dated, signed record of what their security spend bought, written so they can read it without you in the room. At renewal you start from that record.

Coverage

catalog 2026.11.1-phase1

Nineteen controls in the catalog. Eight of them are measured today.

This is the real catalog, weighted the way the scorer weights it. Dark segments are controls read from Microsoft 365 or public DNS today. The light ones print as "not verified" on every report until we connect a source for them.

Verified from Microsoft 365 or public DNS Printed as "not verified" until a source is wired

8 / 19

Controls verified

66 / 145

Scored weight covered

Knockout controls

Statuses ever inferred

See all nineteen controls

Made for your console. Written for your client's QBR.

Fleet posture

Your whole book on one screen, every tenant scored and ranked by risk.

Remediation simulator

Toggle a fix and see how far the score moves before you recommend it.

White-label reports

Your name and colors on every report. Your clients never see ours.

Drift detection

Designed, not built yet. Every scan already produces the signed records it will compare.

See the full platform

We don't keep your clients' data.

Each scan reads, scores and discards. Armada has no database for raw security data.

Collect

Armada reads posture from Microsoft Graph into memory using three read-only permissions. It has no write access, so it can't change a tenant.

ii.

Evaluate

Nineteen weighted controls, eight of them measurable today. The score counts only what the scan verified. MFA enforcement is a knockout: a verified failure caps the grade no matter what else passes. A control the scan can't reach is a coverage gap, not a failure.

iii.

Destroy

Raw data is dropped when scoring finishes. Nothing in the system can store it.

iv.

Attest

One signed record is kept: the score, each control's status, the catalog version, and an ECDSA P-256 signature chained to the previous scan. Edit an old record and the chain breaks. The public key is published and the checker runs in your browser, so your client's auditor can check a record without us. Check one now.

Get early access.

We're working with a small group of MSPs before wider release. A founder reads every message.

Request early access