From the Field: Sales Insights for SMB IT Leaders 
Insights from the cybersecurity conversations we’re having every day with SMB IT leaders.  Every week, our team meets with CIOs, IT Directors, and technology leaders across the country. While every environment is different, many of the questions—and misconceptions—we hear are surprisingly consistent. In this series, we’re sharing the conversations that matter most to help SMB IT leaders make more informed cybersecurity decisions.  By Stephen Stemme For many small and mid-sized businesses, Microsoft 365 and Google Workspace have become the foundation of daily operations. Email, file sharing, collaboration, identity management, and productivity all live within these platforms. Because these environments are managed by Microsoft and Google, it’s easy to assume they are secure by default. In reality, the security of your cloud environment depends largely on how it’s configured. Both Microsoft 365 and Google Workspace include hundreds of configurable security settings. While the platforms provide powerful security capabilities, they can’t determine which settings are appropriate for every organization. That responsibility ultimately falls to the organization managing the environment. For SMB IT teams juggling infrastructure, user support, cybersecurity, and business initiatives, reviewing every configuration against evolving best practices is rarely realistic. 

Cloud Security Isn’t Just About Having the Right Features 

Microsoft and Google continue to invest heavily in security. Features like multifactor authentication, conditional access, data loss prevention, email security, and identity protection can significantly reduce cyber risk. However, these capabilities only provide value if they are configured appropriately.  We’ve worked with organizations that owned advanced security features but weren’t fully utilizing them because important settings remained disabled, configured incorrectly, or hadn’t been reviewed since the environment was first deployed. The result isn’t necessarily a vulnerable platform, it’s a platform that isn’t delivering the level of protection it was designed to provide. 

Why Misconfigurations Matter 

Many successful cyberattacks don’t occur because organizations lack security tools, but because existing tools aren’t configured according to security best practices. Common configuration issues can include overly permissive sharing settings, incomplete multifactor authentication enforcement, legacy authentication remaining enabled, excessive administrative privileges, or identity policies that no longer align with current business needs. Individually, these issues may seem minor. Together, they can create opportunities for attackers to gain access, escalate privileges, or move through cloud environments more easily than intended. Configuration reviews help uncover these gaps before attackers do. 

Measuring Your Environment Against Industry Best Practices 

One of the biggest challenges for IT leaders is knowing what “good” actually looks like. Security best practices continue to evolve, and Microsoft’s or Google’s recommended settings may change as new threats emerge. Instead of relying on assumptions, organizations can assess their environments against recognized industry standards such as the Center for Internet Security (CIS) Benchmarks. These benchmarks provide practical, consensus-driven recommendations developed by cybersecurity professionals to improve the security of cloud platforms. Using an established framework allows organizations to evaluate their environment objectively rather than relying on guesswork. 

More Than a Scorecard: Actionable Remediation Guidance 

A security assessment should do more than identify configuration issues. A comprehensive assessment produces a detailed report outlining where configurations differ from best practices, why those settings matter, and what changes should be considered to strengthen the environment. Rather than simply listing findings, the report provides actionable remediation guidance that helps IT teams prioritize improvements based on security impact. For organizations with lean IT staff, this roadmap can significantly reduce the time required to research individual recommendations and determine where to begin. 

Why an Independent Assessment Provides Greater Value 

A common question we hear is: “Why have a third party assess our Microsoft 365 or Google Workspace environment if Microsoft and Google already provide security recommendations?”  It’s a fair question.  Microsoft and Google build exceptional platforms and provide valuable security guidance. However, they are also the platform providers.  An independent assessment offers a different perspective.  Rather than focusing on available features, a third party evaluates how your specific environment has been configured against established security benchmarks and real-world implementation best practices. Because the assessment is objective, it can identify configuration gaps, inconsistencies, and opportunities for improvement without being influenced by how the environment was originally deployed. For organizations without dedicated Microsoft or Google security specialists, this independent review provides additional confidence that the platform is configured to support the organization’s security goals. 

How This Complements Vulnerability Management 

Configuration assessments and vulnerability management solve different, but complementary, problems. Vulnerability management focuses on identifying software vulnerabilities and known Common Vulnerabilities and Exposures (CVEs) across systems and applications. Configuration assessments evaluate whether cloud platforms like Microsoft 365 and Google Workspace are configured securely according to industry best practices. Together, they provide a more complete picture of an organization’s security posture by identifying both technical vulnerabilities and configuration-related risk. 

Key Takeaways for IT Leaders 

Cloud platforms have made enterprise-grade security more accessible than ever before. But simply owning powerful security features doesn’t automatically translate into a secure environment.  An independent security assessment helps organizations identify misconfigurations, compare their environments against recognized best practices such as the CIS Benchmarks, and receive actionable recommendations for improvement.  For SMB IT teams, this type of assessment provides confidence that cloud security investments are delivering their intended value while reducing the time required to evaluate complex configuration settings.  An independent assessment doesn’t replace the built-in guidance from Microsoft or Google, it complements it by validating your environment against established best practices and providing a practical roadmap for continuous improvement.  Want to better understand how your Microsoft 365 or Google Workspace environment is configured? 👉 Book a consultation with Stratus ip to learn how an independent cloud configuration assessment can help identify security gaps and provide actionable recommendations for improvement.