PAT checks your Defender XDR and Entra settings against what actually stops attacks. Get results in 10 minutes. Organizations with 300+ users also get a free action plan session with a Microsoft-certified security engineer.
Run my free assessmentRead-only. In 10 minutes.
What gets checked
Secure Score
PAT
Identity hygiene
Conditional Access logic
Privileged roles, PIM, and break-glass
App, service principal, and agent permissions
Defender features enabled
Verified deployed and healthy on devices
Core mail protection
Enhanced mail protection
SPF, DKIM, and DMARC at the source
Detection products licensed
Detection stack deployed and reporting
10 minto results
$0for the assessment
200+settings checked
The setup
Microsoft Defender for Endpoint, on every device.
What PAT found
Sensor health failures on some endpoints, caused by network, registry, and configuration problems.
Why it mattered
A malware incident on those devices could have run with no visibility, even with endpoint detection and response (EDR) “deployed.”
The setup
The resource owner password credentials (ROPC) flow lets attackers sign in to Entra apps without multi-factor authentication (MFA).
What PAT found
We added a check within a week of public disclosure. At one customer, the flow was enabled on more than 50 apps.
Why it mattered
Left open, attackers could authenticate to those apps and skip MFA.
Sample, illustrative
Entra ID
62
Defender for Endpoint
48
Defender for Cloud Apps
71
M365 Applications
80
Defender for Office 365
57
Exchange Online
68
DNS Config
35
Sign in with your Microsoft work account and approve access. Whoever connects needs permission to add an enterprise app in Entra ID. Nothing to install.
In 10 minutes, you get findings ranked by risk, mapped to MITRE ATT&CK, and explained in plain language.
Organizations with 300+ users qualify for a free action plan session with a Microsoft Certified Security Engineer. They'll turn your findings into a plan: what to fix first, and why.
Of the 11 areas below, the two tools agree on 3. PAT goes further on the other 8.
What gets checked
Microsoft Secure Score
Critical Start PAT
Authentication methods (MFA, passwordless), authorization and external-collaboration policies, cross-tenant access.
Inspects Conditional Access logic and policy requirements.
Privileged Identity Management role policies, admin health, and break-glass account detection.
App registration and service principal hygiene.
Both confirm the feature is enabled.
Agent health, ASR rules, antivirus configuration, and device-group inventory from the machines API.
Exchange Online compliance; Defender for Office 365 anti-phishing, anti-malware, Safe Links, and Safe Attachments.
Attackers get around basic recommendations. PAT checks protections built for more sophisticated attacks.
Email authentication DNS records checked at the source.
Both confirm the products are licensed.
Defender XDR metrics via Advanced Hunting, Defender for Identity sensor health, Defender for Cloud Apps connector health.
Covered
High level only
Not covered or not verified
Source: Critical Start, Going Beyond Microsoft Secure Score (2026). Comparison reflects Critical Start's assessment.
PAT looks at 200+ settings across seven areas of your Microsoft 365 environment.
Every finding is tied to the attack techniques it leaves open, so you know what to fix first.
Each check says what it does and why it matters. No decoder ring needed.
See where you stand against Standard Protection (best practice) and Zero Trust (most secure available).
Export and share the report. Re-run it later to show leadership how far your posture has come.
Sample report page
Illustrative.
Legacy sign-in flow enabled on multiple apps
Entra ID
Endpoint sensor unhealthy on a group of devices
Defender for Endpoint
Enhanced mail protections not turned on
Defender for Office 365
DMARC policy set to monitor only
DNS Config
PAT reads security and configuration settings only. It can't read your email, files, or messages.
A single-purpose app registration, scoped to what the assessment needs.
Remove PAT's app registration in Entra ID to revoke access. Delete your stored data from the PAT interface. No ticket required.
Need a security review first? Read the PAT Tenant Setup Guide for the full permission list.
Critical Start is a Microsoft Security Partner and a member of the Microsoft Intelligent Security Association (MISA). Our engineers choose every PAT check and review every finding. Automation collects the data. People make the calls.
We built PAT because answering "Will Defender stop the next attack?" took about 20 hours of manual data collection. Now we use it on every engagement, and we want other blue teams to have it.
Here's what happens, plainly.
You get your results in 10 minutes, whatever your size.
If you have 300+ users, we'll follow up to schedule your action plan session. That's the extent of the pitch.
Your access is yours to keep. Fix a few things, re-run the assessment, and watch your score improve.
Read-only. In 10 minutes.
