Recurring deliverable · Adeo Pulse Within the first three business days, every month

The monthly governance document the leadership desk has never had.

On the leadership desk within the first three business days of each month: one verdict, scored across five domains — service delivery, commercial discipline, roadmap and governance, security and compliance, and AI adoption and posture. Each one cross-walked to the ACSC Essential Eight, ISO/IEC 27001:2022, NIST CSF 2.0 and CIS Controls (the AI domain read against the NIST AI RMF and ISO/IEC 42001:2023), alongside the control set your insurer will hold you to at renewal.

A principal reads every issue, signs it, and stands behind every finding. Pulse measures what your MSP delivers, reading the outcome rather than running the systems. Leadership gets an independent monthly record to table at a board meeting, hand to an insurer, or put in front of a regulator without commissioning a fresh assessment each time.

Start a Conversation →

Two ways to subscribe

Essential

Standalone monthly Pulse for smaller organisations. The full issue — five-domain scorecard, technical appendix, MSP forward email, roadmap delta, glossary, methodology and principal sign-off. Also the bundled deliverable on the Lite and Foundation advisory retainers.

Premium

For larger organisations and groups. The same issue with every integration in scope, and a quarterly thirty-minute review.

Cadence: Monthly · within the first three business days
Fee: Fixed-fee · set in the written proposal
Setup: One-off · scoped in the written proposal

Pulse is onboarding now; your first monthly issue is scheduled in the written proposal. Groups and bespoke insurer cross-walks are scoped on request.

Specimen issue · July 2026

An issue, read end to end.

Page one below is the issue as leadership would receive it; the remaining five pages open when you want them. Warburton & Field Lawyers, its MSP and the renewing insurer are invented for this specimen — every name, score, evidence reference, date and figure is synthetic.

Issue 07 · July 2026 · Warburton & Field Lawyers Commercial in Confidence p. 01 / 06

The July verdict

Insurer-ready — with conditions.

Against the renewing cyber insurer’s control set, at the January 2027 renewal.

Overall posture · Amber · ↓ 1

Executive line

July’s signal is licence over-assignment in Microsoft 365 and a slipped restore-test cycle; the latter is the single open item the insurer is most likely to surcharge at renewal. Roadmap remains ahead of original commitment, and identity hardening reached 100% MFA on human accounts in the period.

Five-domain score

Service delivery	86	↑ 1
Commercial	71	↓ 3
Roadmap & governance	82	↑ 3
Security & compliance	78	↓ 3
AI adoption & posture	74	↑ 2

Three for your attention

01. Backup restore-test evidence is 113 days overdue. The renewing insurer expects quarterly evidence. If unactioned at the January renewal, the policy is likely to issue with a 7–15% premium loading against the relevant control — A$3,150 to A$6,750 across the year on the current premium. Owner: MSP.
02. Fourteen Microsoft 365 E3 seats are unused — absent from sign-in logs for more than ninety days. About A$630 per month recoverable, A$7,560 across the year. Ownership sits with leadership — the cleanest commercial decision available this quarter.
03. Two privileged service accounts remain without MFA — both predate 2024. A control failure against insurer §3.1 if persistent at renewal. Either retire the accounts or enforce certificate-based authentication. Owner: MSP for execution; Adeo for evidence capture into Issue 08.

This month’s wins

MFA coverage reached 100% of human accounts — the last legacy human identity was retired on 17 July.
Patch compliance moved from 91% to 96% across the estate.
Eight of fourteen Baseline Audit roadmap items are now closed; full closure is forecast for October 2026, six weeks ahead of the original commitment.

Signed off — Adeo, 26 July 2026. Principal · Adeo Partners Pty Ltd. Adeo Partners Pty Ltd · ABN 50 698 595 523

Adeo Pulse · July 2026 Page one · Executive scorecard

Pages two to six of the specimen

Issue 07 · July 2026 · Warburton & Field Lawyers Technical appendix p. 02 / 06

Finding 01 of 03

Severity highWorsened from amber to red113 days overdue

Backup restore-test evidence is overdue.

Each finding carries evidence, framework cross-walk, ownership and a costed impact.

Evidence

The backup platform’s orchestrated job log records the last successful witnessed restore at 2026-01-04 21:14 ACDT; the subsequent quarterly cycle has not been scheduled. Evidence reference WF-BKP-Q1-2026-RST.

Plain-English impact

Without witnessed restore evidence in the period, the insurer’s quarterly evidence requirement is not satisfied. At renewal in January 2027 the policy is likely to issue with conditions or a surcharge against control §4.3.2.

Ownership

MSP for execution. Adeo for evidence capture into Issue 08.

Remediation

Schedule a restore test for the week commencing 3 August. Witness the session with a recorded artefact; lodge the artefact reference for inclusion in Issue 08.

Cost of inaction

The insurer’s current loading guidance is 7–15% premium loading for non-compliance with restore evidence — A$3,150 to A$6,750 across the year on the current premium. Adeo does not underwrite or bind insurance; the figures are indicative and for your broker to confirm.

Month-on-month

Worsened from amber (Issue 06) to red (Issue 07). The restore window is now 113 days past the insurer’s ninety-day expectation.

Framework cross-walk

ACSC Essential Eight: Regular backups — restoration testing required.
ISO/IEC 27001:2022: A.5.30 — ICT readiness for business continuity. A.8.13 — Information backup.
NIST CSF 2.0: RC.RP-04 (Recovery plan execution) and PR.DS-11 (Backups maintained).
Insurance policy: §4.3.2 — quarterly witnessed restore validation.

Findings 02 (Microsoft 365 E3 over-assignment) and 03 (privileged service-account MFA) follow this same evidence pattern in the full issue.

Adeo Pulse · July 2026 Page 2 of 6 · Technical appendix

Issue 07 · July 2026 · Warburton & Field Lawyers Forward without edit p. 03 / 06

For your MSP

A pre-written email to your account manager.

Each month, your only job is to hit forward.

To: account-manager@msp.example
Cc: Adeo
From: James Warburton, Managing Partner
Subject: Pulse 07 — three items flagged for action by 1 August

Hi Daniel,

Adeo’s monthly Pulse for Warburton & Field, July 2026, has flagged three items where action is requested from your side. Evidence references in the attached PDF; brief summaries below.

Backup restore-test evidence overdue. The last witnessed restore was 4 January. The renewing cyber insurer expects quarterly evidence and we are now 203 days past the last test — 113 days beyond its ninety-day expectation. Can you schedule a restore test for the week commencing 3 August, with a witnessed session captured for inclusion in next month’s Pulse? Evidence reference WF-BKP-Q1-2026-RST.
Two privileged accounts without MFA. Service accounts svc-app-warburton and svc-mgmt-warburton — both long-standing legacy. Can either be retired, or MFA enforced via certificate-based authentication, by 21 August? Evidence reference WF-IDM-PRIV-2026-07.
External sharing up 31% in the period. Recognised as the matter-management rollout. Can you forward the SharePoint external-sharing log so Pulse can confirm the increase is bounded to the rollout and not unrelated drift? Evidence reference WF-SP-EXT-2026-07.

A response by 1 August would help close these items in next month’s Pulse. Happy to discuss any of these on a fifteen-minute call.

Thanks,
James — Warburton & Field Lawyers
cc’d: Adeo — oversight

Written to be pasted into Outlook word for word. Adeo does not send it — the relationship with your MSP stays direct, and Adeo is cc’d so the response is captured into next month’s Pulse. The email carries only the items for the MSP to action; the licensing decision on page 1 sits with leadership.

Adeo Pulse · July 2026 Page 3 of 6 · For your MSP

Issue 07 · July 2026 · Warburton & Field Lawyers Roadmap delta p. 04 / 06

Baseline Audit roadmap

57% closed at eight months in.

Delivered 1 November 2025. Forecast full closure 31 October 2026 — six weeks ahead of the original December 2026 commitment.

Total items

14

Closed

8

In progress

4

Open

2

Closed on or ahead of target

Conditional access ruleset hardening14 Jul
Entra sign-in log export automation22 Jun
Defender for Endpoint estate coverage09 Jul
Guest account quarterly review03 Mar
Safe Links & Safe Attachments enforcement27 Feb
Privileged Identity Management rollout11 Feb
Breached-credential monitoring on-domain22 Jan
Documentation currency audit14 Jan

In progress checkpoint dates set

Windows 11 migration · six endpoints remainingTgt 20 Aug
Backup immutability enforcementTgt 30 Aug
Matter-management external sharing reviewTgt 23 Aug
Insurer control cross-walk · 2027 cycleTgt 31 Oct

Open MFA enforcement also flagged on page 1

Privileged service-account MFA enforcement87 d open
Disaster-recovery tabletop exercise118 d open

Adeo Pulse · July 2026 Page 4 of 6 · Roadmap delta

Issue 07 · July 2026 · Warburton & Field Lawyers Glossary p. 05 / 06

Plain English

For when this document is forwarded.

Terms used in this issue, for the CFO, the board and the insurer.

MFA coverage: The percentage of accounts with multi-factor authentication enforced. Insurer expectation: every account, with no exceptions — privileged and human alike. Pulse counts enforced coverage only, because a registered-but-not-enforced control fails at audit.
Conditional Access drift: When the rules controlling who can sign in — from where, on what device — change without a documented approval. Drift is a governance risk: access can widen without leadership ever approving it.
Immutable backup: A backup that cannot be deleted or altered for a defined retention period, even by an administrator. The defence against ransomware that encrypts the backups along with the production data.
Restore-test evidence: Witnessed proof that backups can actually be restored within the agreed window. An untested backup is unproven; insurers ask how often a restore is tested, and the specimen insurer expects it quarterly.
Insurer §: The question on your insurer’s proposal form, or the policy condition, that a Pulse finding maps to. Cited so that what you attested at renewal can be evidenced if a claim is ever questioned.
Pulse delta: The month-on-month change in posture. Resolved means closed since last issue; New red means newly flagged this month; Worsened means the score moved down vs the prior period.

Adeo Pulse · July 2026 Page 5 of 6 · Glossary

Issue 07 · July 2026 · Warburton & Field Lawyers Methodology & sign-off p. 06 / 06

Methodology

How this document is made.

Data collection

Read-only, authenticated access to your own systems: no agents on your endpoints. Evidence is held on encrypted, access-controlled infrastructure in Australia, with strict per-client separation. The particular tools and sources behind each reading are set out for you under engagement, rather than on a public page.

Review & sign-off

Every Pulse issue is read front to back by a principal before release and signed off in their name. The principal writes the executive line on page 1; the MSP forward email on page 3 is written to be pasted and sent verbatim.

This is an advisory assessment of the controls observed from client-supplied evidence as at the assessment date. It is not an audit opinion, certification, or guarantee of security, and confers no third-party reliance without Adeo’s written consent.

Cadence & archive

Within the first three business days of each month. Every issue is kept as a durable, secure record your board or insurer can draw on — past issues, trend lines, findings and MSP forward emails all retained, without you maintaining the archive.

Signed off, Adeo

26 July 2026

Principal

Adeo Partners Pty Ltd

ABN 50 698 595 523

Issue 07 of an ongoing monthly series prepared for Warburton & Field Lawyers. Commercial in Confidence.

Adeo Pulse · July 2026 Page 6 of 6 · End of issue

Service delivery

Is service delivery meeting the contract?

Whether the service desk is meeting the response and resolution times in your contract, where the same issues keep coming back, and whether your MSP’s own monthly report matches the ticket record. Where ticket data isn’t made available, Pulse notes the gap.

Commercial

Is your spend efficient?

Whether every licence you pay for is assigned and at the right tier, whether invoices match the contract and what was actually consumed, and whether third-party charges sit in line with published pricing. Every commercial finding carries its cost of inaction.

Roadmap & governance

Is the agreed work getting done?

How the Baseline Audit roadmap is closing, item by item and owner by owner. Whether your documentation would survive a change of provider. Whether the quarterly commitments your MSP made are being kept.

Security & compliance

Are the controls your insurer expects in place, every month?

Identity, endpoints, email, backups and external exposure, read each month against the ACSC Essential Eight and the control set your insurer expects at renewal, with the month’s movement shown alongside.

AI adoption & posture

Is the AI your team is using defensible to your regulator and your insurer?

Which AI tools are in use across the firm — sanctioned, unsanctioned, and the AI features embedded inside the software your team already pays for — and how their data handling stands against AHPRA principles, your Law Society’s guidance or APES 110. Read against the NIST AI RMF and ISO/IEC 42001:2023.

Pulse is monthly, point-in-time oversight; it measures whether the outcome held.

Does Pulse replace our MSP?

No. Pulse measures what your MSP delivers across five domains and hands you evidence suitable for board review each month. Real-time alerting and operational response stay with the MSP; Pulse is read-only and never operates the systems it scores. It is built so the MSP stays exactly where it is — the monthly scorecard keeps the relationship accountable, with both sides working from the same independent read.

How is Pulse priced?

Pulse comes in two forms — Essential for smaller organisations and Premium for larger ones. Groups, multi-entity structures and bespoke insurer cross-walks are scoped on request. The fixed monthly fee is set in the written proposal.

Do we need a Baseline Audit before starting Pulse?

Yes. Pulse scores month-on-month movement against an established position, so a Baseline Audit comes first; where a Quick-Scan has already fixed the position on the domain that matters, Adeo will say whether that is enough. With a baseline in place, Pulse is onboarding now, and the written proposal sets the month your first issue arrives.

Next step

A thirty-minute conversation, before any commitment.

At no cost and with no obligation: a half-hour read on whether Pulse fits your situation, and an honest answer if it does not. Pulse is onboarding now; with an MSP in place and a starting position established, the written proposal sets the month your first issue arrives.

Send your most recent MSP monthly report and your current cyber-insurance renewal questionnaire with the first email, and the first reply will already have something to say. A reply follows within one business day.