What Holm announced
Holm's announcement says the assessment evaluates a tenant against more than 100 controls based on the CISA Secure Cloud Business Applications (SCuBA) baseline. Holm contrasts this with traditional vulnerability scanning, which looks for missing patches and known software flaws. The new checks look at identity, email, collaboration and data-protection settings. Holm says the feature is meant to complement Microsoft Secure Score by giving an independent view next to Microsoft's own recommendations.
Holm's customer support note from October 12 adds operational detail:
- Where it runs: Holm says it runs in Security Center and assesses the tenant continuously.
- Workloads covered: Holm lists Microsoft Entra ID, Exchange Online, Microsoft Teams, Microsoft Defender for Office 365 and SharePoint Online.
- Results: Findings appear next to Holm's existing network, web and cloud findings.
- Output per check: Each check returns pass or fail, names the affected users, groups or settings, and links to remediation guidance in the relevant Microsoft admin center.
- Access: Holm says access is read-only and enforced through Microsoft's Global Reader role, so the assessment cannot change tenant configuration.
- Drift: Holm says it detects configuration drift when administrators change settings or Microsoft introduces features with insecure defaults. It also says it will add checks as the SCuBA baseline evolves.
Who gets it, and at what cost
The press release says the assessment is included at no extra cost for existing customers. Holm's support note is more specific. It says the feature is included in the System & Network Security and Cloud Security subscriptions, and that it is available only with cloud deployment. Customers on on-premises deployments should not assume they get it.
The release also says the feature joins Holm's Active Directory security assessment, launched earlier this year. Holm describes the pair as covering identity and cloud risk. That is product positioning. The material I reviewed does not independently verify how complete the coverage is.
Examples of what it checks
Holm's feature page gives examples by area. It is not a full control list, and I could not find a complete, versioned inventory.
| Area | Examples Holm names |
|---|---|
| Identity and access | MFA enforcement, Conditional Access policies, privileged identity management alerting, guest access, dormant admin accounts |
| Email security | DKIM and DMARC enforcement, anti-phishing and anti-malware policies, mail-flow rules, external forwarding |
| Collaboration | External access, meeting policies, app permissions, federation settings |
| Threat protection | Safe Links, Safe Attachments, audit logging, alert routing |
| Data protection | SharePoint Online external-sharing defaults, "Anyone" links, link expiration, guest re-authentication |
Holm says its page describes a configuration check, not live monitoring. In its words, it is about fixing the locks, not watching the security camera. This tool will not tell you an attack is happening. It tells you where the tenant is exposed by design. It does not replace Defender, Sentinel-style monitoring or incident response.
SCuBA background, and the free alternative
CISA's SCuBA project publishes secure configuration baselines for Microsoft 365. CISA describes SCuBA as providing tailored cloud solutions guidance and secure configuration baselines for Microsoft 365 and Google Workspace applications. CISA's 2022 announcement said the documents are easily adoptable recommendations that complement an organization's own requirements and risk tolerance. That announcement also said they are principally intended for federal agencies, while recommending that other cloud users review them.
CISA also publishes its own assessment tool. The December 2023 release of the finalized baselines came with an updated ScubaGear tool that assesses M365 cloud services against CISA's recommended baselines. ScubaGear verifies that a tenant's configuration conforms to the policies in the SCuBA baseline documents. CISA's documentation also advises reviewing results and then either updating the tenant configuration or documenting risk acceptances in a YAML configuration file. In practice, a failed check is a prompt to investigate. It is not an order to flip the setting.
So Holm is not offering access to a baseline that was previously unavailable. The baseline and a free assessment tool already exist. What Holm adds is continuous assessment inside a platform some organizations already pay for, with findings alongside network and cloud results. Whether that is worth it depends on whether you already run ScubaGear on a schedule and whether you want one place to track findings.
Reading the claims carefully
- The count. Holm's "over 100 controls" refers to its own checks. CISA's wider baseline set has been described as larger. Holm does not say it implements every SCuBA control, and the baseline's origin does not mean CISA has approved or certified Holm's tool.
- Secure Score comparison. Holm says Secure Score reflects Microsoft's recommendations for its own products, while its tool measures against a federal baseline. That is Holm's description. I found no independent feature-for-feature comparison.
- Marketing language. The "one platform, one workflow" line and the claim that it eliminates tool fragmentation come from Holm's product manager. The sources do not quantify time saved or security outcomes.
- Compliance. Holm's page mentions NIS2 and DORA as reasons for a repeatable approach. A configuration check does not by itself guarantee compliance with either.
Practical checklist for administrators
- Confirm eligibility. Check whether you hold System & Network Security or Cloud Security, and whether you use cloud deployment.
- Review the access model. Holm says it uses Global Reader. Your security team should still confirm what consent and permissions the connection requires, and how Holm handles the resulting tenant data. The material I reviewed does not cover setup steps or data-handling terms.
- Check licensing. The sources do not state minimum Microsoft licensing. Some SCuBA policies depend on Defender for Office 365 or Entra features, so failures may reflect licensing as well as settings.
- Triage before fixing. Prioritize items such as MFA gaps, legacy authentication, external forwarding and anonymous SharePoint links. Test changes, because tightening settings can break business workflows.
- Document exceptions. Record accepted risks, as CISA's own tooling encourages.
- Compare results. If you also run Secure Score or ScubaGear, compare the outputs to see where they disagree.
Bottom line
This is a vendor launch, and its strongest claims are marketing. The concrete news is narrower and still useful. Eligible cloud-deployed Holm customers get a read-only, SCuBA-based Microsoft 365 configuration check at no extra charge. It covers five Microsoft workloads, and the results sit next to their other scan findings. Its value over free tooling depends on how much you want continuous checks and consolidated reporting.