Exposures small IT teams miss
Sensitive files shared outside the organisation
Records, referrals and reports are shared externally for good reasons, and the links stay live long after. Each one is a data exposure risk.
Stolen Microsoft 365 credentials
Microsoft 365 was linked to 52% of healthcare email breaches in the first half of 2025 (Paubox). One phished password can open a mailbox full of patient correspondence.
Suppliers as a way in
Attackers increasingly go through the third parties that support clinical, billing and cloud operations, and NIS2 expects that supplier risk to be managed.
Connect data and device signals
Shared links stay live and device posture slips. TENET reads SharePoint and OneDrive sharing alongside Intune compliance and Defender findings, so one view shows where a record could leave or an endpoint could be used against you.
- Shared content from both file stores in one list
- Device compliance next to endpoint findings
- Data and device signals read together, not in separate consoles
Referral letters folder
Shared with an external recipient
Ward-laptop-14
Device out of compliance · open Defender finding
Clinic-tablet-03
Policy drift · patch overdue
Admin-desktop-07
Compliant · no open findings
Ward manager mailbox
Sign-in from two countries within an hour
Defender incident
Malware on a clinic laptop
Legacy mail client login
No multifactor prompt
Reception PC sign-in
Known device and location
Stop account takeover early
TENET reads Entra sign-in and audit activity and brings forward impossible travel, legacy sign-ins and repeated failed attempts. Microsoft Sentinel and Defender incidents sit on the same graph, linked to the accounts and devices involved.
- Sign-in risk ranked by account
- Sentinel and Defender incidents in one list
- Any incident sent to BriteAI for investigation
Prove NIS2 readiness
Health is one of the sectors NIS2 names. TENET maps your Microsoft 365 and Azure configuration to NIS2 articles and keeps policies, the risk register and supplier reviews next to the technical controls, with questionnaires you can send to suppliers.
- Failing controls with fix steps
- Policies and risks with review dates
- Supplier register and questionnaires
Article 21(2)(j) · multifactor authentication
Failing · clinical accounts
Lab results supplier
Supplier review overdue
Incident response policy
Review due next month
Backup policy
Active
patient-portal
Exceptions rising since last deploy
Referrals site
Shared externally before Copilot rollout
booking-api
Slower than usual
Copilot
40 users ready
Keep patient services running
Patient portals and booking apps on Azure are watched against learned baselines, with application failures from Application Insights. Before Copilot reaches clinical teams, TENET shows which users are ready and which sites are shared too widely.
- Workload and application drift
- Copilot readiness per user
- AI agents without an owner
FAQs
We have a small IT team. Is TENET realistic for us?
Yes. TENET ranks findings by risk so a small team knows what to fix first. Setup uses read-only access with no agents to deploy.
Run the free Self-Service Assessment to see your own findings ranked by risk.
Is the health sector in scope for NIS2?
NIS2 covers the health sector, including healthcare providers and laboratories, depending on the size of the entity and how its EU member state has transposed the directive. TENET maps Azure and Microsoft 365 findings to NIS2 articles.
Read how TENET supports NIS2 compliance and NIST CSF 2.0.
Does TENET access our emails, documents or files?
No. TENET reads configuration and security metadata from your Azure and Microsoft 365 tenant through read-only permissions. It does not store, access or process emails, documents or files, and it does not deploy agents.
See the Microsoft cloud integration guide for the exact roles and setup steps.
Find your Microsoft cloud risk
Connect your Azure and Microsoft 365 tenant with read-only access and see which identities, exposures and anomalies matter most.