Managed Microsoft 365 Security for Mortgage Lenders

ABT is a Tier-1 Microsoft Cloud Solution Provider. We sell the same Microsoft 365 licenses at the same price as Microsoft, quoted on their own line. Two things come with that. Guardian Foundation, the hardened tenant baseline, is included at no additional charge. And your Guardian rate is lower, one user at a time, for every user whose license sits with ABT. You are not being asked to make ABT your only Microsoft partner: Microsoft supports more than one partner relationship on the same tenant, so ABT can hold its own access alongside whoever sells your base licenses.

Buying direct gets you the software. Microsoft hosts the infrastructure, but securing the identities, devices, and data inside your tenant is your responsibility, and the default settings favor easy access over strong security. ABT quotes you the same Microsoft licensing at the same Microsoft price, and then Guardian is the part Microsoft does not do: a hardened Zero Trust configuration, and from there round-the-clock detection, automated containment, and human incident response. The two sit on separate lines so you can see exactly what each one costs.

Every rung includes a hardened Microsoft 365 tenant: Zero Trust identity and device baselines, Microsoft Entra ID Conditional Access, multi-factor authentication and single sign-on, Microsoft Intune device compliance, Microsoft Purview data loss prevention, and Microsoft Defender for Office 365 configuration, plus Guardian Security Insights reporting your posture back to you. Guardian Contain adds round-the-clock detection and automated containment. Guardian Respond adds ABT security engineers working covered incidents during business hours, and Guardian Resolve adds after-hours human escalation. Quoted on their own lines, beside Guardian: your Microsoft licensing, end-user helpdesk, and virtual CISO and audit readiness work.

Guardian is priced per user per month and does not include your Microsoft licensing, which is quoted separately at Microsoft price. There are four rungs. Guardian Foundation, the hardened tenant baseline plus Guardian Security Insights, is included at no additional charge when your Microsoft licensing runs through ABT. Guardian Contain, which adds round-the-clock detection and automated containment, is $18 per user per month. Guardian Respond, which adds ABT security engineers investigating and remediating covered incidents during business hours, is $27. Guardian Resolve, which puts a human on the incident at any hour, is $36. Those are the rates when your licensing runs through ABT. If your licensing stays elsewhere, the rungs are $21, $32, and $42. Each paid rung carries a 50-user monthly floor, so a 50-user lender pays exactly the list rate. Onboarding is quoted as a fixed project price per phase.

Microsoft secures the cloud infrastructure, but customers are responsible for securing identities, devices, and data inside their tenant. Default settings prioritize ease of access, not maximum security. Guardian closes that configuration gap by enforcing Zero Trust controls such as MFA, Conditional Access, device compliance, and data protection.

Business Premium is a strong security foundation. It includes Microsoft Entra ID P1, Microsoft Defender for Office 365 Plan 1, Microsoft Defender for Business, Microsoft Intune, and Microsoft Purview data loss prevention. What it does not do is configure itself. Out of the box the defaults favor access over security, and examiners and investor auditors increasingly expect risk-based Conditional Access (Microsoft Entra ID P2) and around-the-clock monitoring that Business Premium alone does not include. Guardian hardens the license you already have and layers on the monitoring, automation, and response that audit expectations call for.

ABT runs a 90-day hardening sprint configuring Conditional Access, MFA, Intune compliance, email authentication, DLP, and sharing restrictions. Most organizations start in the 30 to 40 percent range. After hardening, ABT clients average 93 percent. Guardian then monitors for drift so your score stays high between audits.

There are four rungs and the difference is how far ABT goes. Guardian Foundation hardens your Microsoft 365 tenant, replacing defaults that favor easy access over strong security with Zero Trust baselines, and reports your posture through Guardian Security Insights. Guardian Contain adds round-the-clock detection across identity, endpoint, email, and cloud apps on Microsoft Defender XDR signals, correlated by ABT's own detection engine, with pre-authorized automated containment that revokes a compromised session in seconds at any hour. Guardian Respond adds a human: ABT security engineers investigate and remediate covered incidents during business hours and produce a written incident timeline suitable for an auditor or an insurer. Guardian Resolve adds after-hours escalation: a human on the incident at any hour. Automation contains in seconds; when it does not, our on-call engineer engages immediately, day or night. Microsoft licensing, end-user helpdesk, and virtual CISO and audit readiness work are each quoted on their own line.

Microsoft Defender is the tooling. Managed detection and response is the team and the automation that act on it. Defender generates the signals, but something has to act on them, including at 2 in the morning when a two-person IT team is asleep. Guardian Contain pairs automated containment that runs around the clock with Microsoft Defender XDR signals correlated by ABT's own detection engine. Guardian Respond adds ABT security engineers who investigate and remediate during business hours, and Guardian Resolve has a human on the incident at any hour. If you have Defender but nothing acting on it, you have detection without response.

Yes. A well-governed Microsoft 365 tenant is the prerequisite for safe Copilot adoption. Guardian ensures Microsoft Purview data loss prevention, sensitivity labels, and access controls are in place before AI is switched on, so Copilot only ever surfaces what a user is already allowed to see. Microsoft 365 Copilot itself is quoted separately at Microsoft price, as its own line, so you can add it per user whenever your loan teams are ready.

Copilot can only access what a user can access. If SharePoint permissions or file sharing are misconfigured, AI will surface that data to anyone who asks, and in a lending shop that data is borrower files. Guardian uses Microsoft Purview sensitivity labels, Data Loss Prevention policies, and external sharing controls to reduce oversharing before AI is widely adopted.

Mortgage lenders, brokers, and originators under regulatory examination and investor oversight. Organizations that need continuous compliance documentation, audit-ready reporting, and a partner who understands GLBA Safeguards, state licensing, and investor requirements from Fannie Mae, Freddie Mac, and Ginnie Mae. ABT has served over 750 financial institutions in 25 years.

Guardian is built around the controls GLBA Safeguards examiners, state licensing examiners, and investor auditors test: Zero Trust identity, Conditional Access, device compliance, data loss prevention, logging, and incident response. Every rung hardens and documents those controls, and Guardian Respond produces the written incident timelines auditors ask for. The audit work itself, where ABT maintains your security policies, assembles your Microsoft 365 audit evidence, maps your controls to what auditors test, and works the audit alongside you rather than handing you a binder, is quoted as its own engagement together with the virtual CISO line. ABT supports your audit readiness. No vendor can guarantee what an examiner or an auditor will find, but you walk in with your evidence organized and your controls documented.

Modern attacks often bypass MFA by stealing browser session tokens. Tokenator is ABT's automated response engine that detects suspicious OAuth token behavior and immediately revokes compromised sessions. This is especially important with Copilot because a hijacked session can search and summarize data much faster than a human attacker.

It depends on size. Guardian Foundation, the hardened baseline, is included at no additional charge for any lender whose Microsoft licensing runs through ABT, whatever the seat count. The paid rungs carry a 50-user monthly floor, which means a 50-user shop pays exactly the list rate and a smaller one pays more per seat. Guardian is built for lenders of roughly 50 to 500 users, and the floors are published so you can see where you land before you ask for a quote.

Guardian onboarding is a structured hardening sprint, scoped and quoted per engagement. Phase 1 covers identity hardening and Zero Trust baselines. Phase 2 implements data governance and Copilot guardrails. Phase 3 verifies the result and produces audit-ready documentation. The scope depends on the state of the tenant we start from, so you get a fixed project price per phase before any work begins.

Microsoft 365 Business Premium supports up to 300 users. If your organization grows beyond that limit, ABT will guide you to Enterprise licensing such as E3 or E5. Guardian's hardening, monitoring, and governance approach carries forward, so your security foundation remains intact.

Guardian is an annual subscription that auto-renews at the same price under the terms of your contract, just like your other Microsoft subscriptions, so your protection never lapses between audits. Your Microsoft 365 subscription and tenant stay under your control; the Guardian term covers ABT's management layer, not your software.

Automated containment runs around the clock at Guardian Contain and above: critical risk detections trigger pre-authorized containment, including session revocation, in seconds at any hour, with no human in the loop. At Guardian Respond, ABT security engineers investigate and remediate covered incidents during business hours, with no per-incident charge for covered incidents. At Guardian Resolve, a human is on the incident at any hour: automation contains in seconds, and when it does not, our on-call engineer engages immediately, day or night. Guardian Foundation is self-managed with best-effort support. Your exact severity definitions and response targets are set out in your service agreement.

They are two separate tracks. An end-user support ticket is everyday Microsoft 365 help: a password reset, an Outlook or Teams problem, a how-to question. That is the helpdesk, sold in blocks of hours you can size to your team. A security incident is a confirmed or suspected threat: a stolen session, a phishing compromise, unusual sign-in activity, or malware. That is Guardian, where automated containment acts around the clock and, at the Respond rung, ABT security engineers investigate during business hours.

Nothing moves, because nothing ever left your hands. Your Microsoft 365 tenant and your data are yours and stay exactly where they are. ABT manages your tenant under delegated administrative access that you grant, and you can run more than one Microsoft partner at the same time. If you no longer want ABT, you simply revoke our access. There is no migration, no handoff, and nothing for us to hold. That is the difference between managing your environment and locking you into ours.