CybrOak maps every Intune-managed device to NDPA 2023 section 39 security measures (as implemented by GAID 2025), then to CIS v8, SOC 2 and ISO 27001, and produces the evidence pack your DPCO, auditor and clients can verify. No agent, just read-only Graph consent.
Sample data — Contoso Ltd, illustrative
Endpoints
248
Compliant
81%
Findings
33
Plugs into the Microsoft stack you already run
You already pay for Intune. CybrOak turns its raw telemetry into a prioritized, fixable security posture — without ripping anything out or installing an agent.
One Graph API connection maps your whole fleet to NDPA / GAID 2025, then CIS, SOC 2 & ISO 27001 and produces the white-label evidence packs MSPs hand to clients. No agent, no E5 required.
01
Every device finding mapped to NDPA 2023 section 39 security measures (GAID 2025) first, then CIS Controls v8, SOC 2 & ISO 27001 — with pass/fail status and device coverage per control. Not a dashboard: actual control evidence.
02
One click → a branded PDF mapping the fleet to NDPA / CIS / SOC 2 / ISO, plus CSV and full action log. Hand it to your DPCO or auditor — or white-label it for a client.
03
Every client tenant in one view. Per-client posture, white-label compliance reports, and per-client billing — built for MSPs, not single companies.
04
BitLocker, Defender, Firewall, stale, non-compliant, OS end-of-life, active threats, and missing security patches (CVE exposure) — grouped by rule with severity.
05
Push the fix straight to Intune. Live per-device progress, fully audit-tracked — so the evidence trail writes itself.
06
Just read-only Graph consent — whole fleet visible in 60 seconds. Works on Microsoft 365 E3 / Business Premium; no Defender P2 or E5 upgrade needed.
Anyone can edit a PDF. CybrOak evidence packs are tamper-evident: each one carries a registered Evidence ID and a cryptographic fingerprint, so an auditor can independently confirm it's genuine and unaltered — something few Intune tools offer.
Unique Evidence ID
Every pack is registered the moment it's generated.
SHA-256 fingerprint
Prove the file wasn't altered, byte for byte.
Public verification
Auditors confirm authenticity — no login, no account.
White-label for clients
MSPs hand each client a pack they can independently trust.
SHA-256 · 03633885cc4a3def9b1e7a2c4d5f6081…
Sign in with Microsoft. CybrOak requests read-only access to your managed devices via Graph API. Admin consent unlocks the whole fleet — no per-device agent.
We pull every Intune-managed device, compute a 0-100 risk score, and run all enabled rules. You see the fleet x-ray inside 60 seconds.
Click Apply Fix on any finding. CybrOak pushes the Intune policy assignment, watches per-device progress, and resolves the finding once compliance confirms.
Enable scheduled sync, point a Slack/Teams webhook at the tenant, and let CybrOak do the watching. Weekly digest goes to inboxes; the audit log captures everything.
Request a live demo and we'll connect a sample Intune tenant, score the fleet, and push a remediation — start to finish — on the call.
Fleet risk score
82/100
▲ 6 since last week
Devices
248
Findings
33
High severity
12
You're handing a security tool access to your endpoints — so we built CybrOak to ask for as little as possible, and to be easy to walk away from.
CybrOak requests read-only Microsoft Graph scopes via Entra OAuth. We read your posture — we don't silently change your devices.
Nothing is installed on a single endpoint. We connect once to your tenant through the Graph API — that's the whole footprint.
Access tokens are encrypted at rest, and every customer's data is fully isolated from the next. No shared anything.
Pull consent from Microsoft Entra at any time and CybrOak instantly loses all access to your tenant. You stay in control.
One predictable monthly price per client — never per seat, never per agent. Invoiced in ₦, payable by Paystack or bank transfer. Start with the free NDPA Health Check; there is no card to add.
First offer
Free 7-day NDPA Health Check
One page, delivered by email after your first sync. No card, no commitment.
Get your free Health CheckPer client
up to 100 devices per client
+ 7.5% VAT (₦4,500) shown separately on the invoice
For a single organisation, or an MSP billing one client at a time.
MSP bundle
up to 5 clients
+ 7.5% VAT (₦18,750) shown separately on the invoice
For MSPs: one invoice covering up to five client tenants in one console.
Prices in Nigerian Naira, billed monthly by invoice; 7.5% VAT is added and shown as a separate line. Payment by Paystack or bank transfer. Device limits count Intune-managed Windows endpoints. Formal evidence packs, invoices, the Data Processing Agreement and the contract are always sent by email and kept in your portal. CybrOak produces evidence for NDPA, CIS, SOC 2 and ISO 27001; it is not certified under any of them and does not certify your organisation.
No. CybrOak produces evidence — device-level control status mapped to NDPA 2023 section 39 security measures as implemented by GAID 2025, and to CIS v8, SOC 2 and ISO 27001. It is not certified under any of these frameworks and does not certify you. Your DPCO or auditor uses the evidence; CybrOak makes it accurate and verifiable.
Still have a question?
One page, by email, within 7 days of your first sync: where your devices stand against NDPA section 39, and the three fixes that close most of the gap.