Product
Security posture for Microsoft 365 and Google Workspace.
Pistos Pharos is built to inspect your workspace settings with read-only permissions, explain every risk in plain English, and keep watch between audits. It is in early access: sections marked Planned are not built yet.
Baseline checks
61 checks today: 53 for Microsoft 365 and 8 for Google Workspace.
Pharos starts with the settings that prevent account takeover and data loss: phishing-resistant MFA, Conditional Access, legacy protocol blocking, admin role limits, external file sharing and mailbox forwarding rules. More checks are being added, and the catalogue is open for anyone to browse.
Of the 53 Microsoft 365 checks, 28 are read from your tenant and 25 you confirm by hand: Microsoft gives an application no read-only way to read those settings (most Exchange, Defender, Teams and SharePoint policies), and Pharos will not ask for a permission that can change your tenant. Each one says exactly where to look and what good looks like, keeps your name and the date, and asks again after 180 days.
Every check is mapped to SOC 2, ISO 27001, NIST CSF 2.0 and NIST 800-171, and many to the CISA SCuBA baselines. Running the checks against a live tenant is in early access and not open yet.
- Passing
Phishing-resistant MFA required for all admins
CIS M365 1.1.1 · SOC 2 CC6.1
- 14 accounts exposed
Legacy authentication protocols blocked
CIS M365 1.1.3 · NIST PR.AA-01
- Needs review
External Google Drive sharing restricted to known domains
CIS GWS 4.1.2 · ISO A.9.4
Examples use illustrative data.
OAuth & shadow IT
See every third-party app your employees authorized.Planned
Employees connect AI note-takers, browser extensions, and productivity apps using "Sign in with Microsoft" or "Sign in with Google". Some only verify identity; others ask for full read/write access to company email and Drive files.
Pharos is planned to list every OAuth grant in your tenant, grade the risk of its scopes, and let you approve known tools, flag risky ones for removal, or send the vendor to Pistos for a vendor assessment.
Third-party OAuth grants requiring a decision
MeetingScribe AI · 19 users (`Mail.ReadWrite`)High risk
PDF Helper Chrome Ext · 4 users (`Drive.Readonly`)Review scopes
Slack · 84 users (`openid`, `profile`)Authorized
Examples use illustrative data.
People & access reviews
Quarterly access reviews without spreadsheets.Planned
SOC 2 and ISO 27001 require periodic reviews of who has access to your workspace, who holds admin privileges, and whether departed employees were offboarded promptly.
Pharos is planned to list every account with its MFA method, admin roles and last sign-in date, flag accounts unused for 90 days, and let a reviewer sign off on an access review PDF.
84 active accounts · 3 Global Admins · 0 dormant accounts > 90 days · Signed off by CISO
Examples use illustrative data.
Continuous drift watch
Know the day a setting changes.Planned
Passing an audit once is easy; keeping settings hardened when three admins are troubleshooting a delivery issue on a Friday afternoon is hard.
Pharos is planned to snapshot your tenant configuration on a schedule set by your plan, record a before-and-after difference whenever a policy changes, and send an alert with the step to undo it.
Drift detected: SharePoint external sharing
Changed from ExistingGuestsOnly to Anyone on acme.onmicrosoft.com. Anonymous links can now be created without sign-in.
Examples use illustrative data.
Pistos Trust Labs suite
Evidence for Kanon, vendors for Pistos.Planned
If you use Kanon for compliance, Pharos is planned to send passing checks to your SOC 2, ISO 27001, NIST and CIS controls as evidence.
If you use Pistos for vendor risk, a new third-party app found in your OAuth grants will be sent to Pistos as a vendor. Nothing is sent today.
48
Baseline gap
78
In remediation
96
Synced to Kanon
Examples use illustrative data.
See every gap in every Microsoft 365 and Google Workspace tenant.
Pharos is in early access: request a place, and connect with read-only permissions when it opens. Planned pricing starts at $149 a month for every tenant, with no per-seat fees.