Security for small firms is increasingly delivered through platforms
TechCrunch reported that London-based Inforcer raised a $50 million Series C led by Insight Partners. Inforcer builds software that managed service providers use to administer Microsoft 365 environments for many small and medium-size clients from one platform. The funding is relevant beyond the startup itself: it reflects demand for scalable security operations aimed at companies that cannot staff a full internal IT and security team.
For an SME, outsourcing administration does not outsource accountability. The practical challenge is to make sure the provider, platform, and client share a clear control model. That includes identity protection, configuration standards, visibility into unauthorized AI use, incident ownership, and evidence that an alert was actually investigated.
What happened
TechCrunch says Inforcer has raised three rounds totaling $110 million in 18 months. Its chief executive reported 300% year-over-year growth, although the company did not disclose its valuation. The article describes a platform initially centered on managing Microsoft 365 configurations across MSP customers, with newer capabilities for shadow-AI detection and threat detection and response.
The company says shadow-AI detection is intended to identify unauthorized AI tools used on company devices. Its executives also argue that attackers are using AI to scale reconnaissance and create more convincing phishing messages. Those statements come from Inforcer leadership and should not be treated as an independent measurement of attack speed or product performance. The larger trend is still credible: cloud identities, SaaS settings, and employee AI use have become part of the same operational security problem.
The company is changing from per-client pricing for its management product toward per-user pricing for threat detection, and it may consider consumption or token-based pricing for future AI features. That is another useful signal for buyers: security and AI costs may move with user count and activity rather than remain a fixed license.
Why it matters for growing businesses
A typical growing company may rely on Microsoft 365 for identity, email, documents, collaboration, and device management. One compromised administrator or poorly configured sharing rule can therefore affect multiple business processes. At the same time, employees may paste customer, HR, or financial data into unapproved AI services because the approved route is unclear or inconvenient.
An MSP can improve consistency by applying configuration baselines and monitoring many tenants with specialized tools. Concentration introduces its own risk. A privileged provider account can reach many customers, an incorrect automation can repeat across environments, and an alert can fall between the platform, MSP, and customer if responsibilities are vague.
The contract should be translated into an operating runbook. Who owns identity alerts? How quickly can sessions be revoked? Which configurations are continuously checked? Can the customer see exceptions and remediation evidence? What happens when an employee uses an unapproved AI tool? Without these answers, a dashboard may create the appearance of control without dependable response.
Build a shared-responsibility control map
List each critical security outcome and assign a responsible party: MFA enrollment, conditional access, administrator review, backup, email authentication, device compliance, log retention, alert triage, containment, and recovery. Record which platform supplies evidence and how often the customer reviews it. This simple map prevents assumptions and supports supplier evaluation when the business grows or changes providers.
Practical action checklist
- Inventory every Microsoft 365 administrator, service account, integration, and external guest.
- Require phishing-resistant MFA and separate daily-use identities from privileged administration.
- Review conditional-access, mailbox forwarding, sharing, OAuth applications, and legacy authentication.
- Define approved AI tools, prohibited data categories, retention terms, and an exception process.
- Ask how the MSP detects shadow AI and distinguish device, browser, network, and SaaS visibility.
- Set severity-based response times and name who may disable accounts, isolate devices, and contact users.
- Require immutable or independently controlled backups for critical cloud and ERP information.
- Review provider privileged access, session logging, staff departures, subcontractors, and breach notification.
- Test one simulated account compromise and one unauthorized-AI scenario with the provider.
- Track open exceptions, time to containment, repeat findings, user coverage, and total per-user cost.
How VDS Consultoria can help
VDS Consultoria helps SMEs turn provider promises into reviewable controls. We can assess Microsoft 365 and Odoo access, map responsibilities with an MSP, define an AI-use policy, improve identity and backup procedures, and create a practical incident runbook. We also help management compare security services based on evidence and response capability rather than feature lists alone.
The funding market may change quickly, but the buyer’s requirement is stable: central management should make controls more consistent and incidents easier to contain. It should never make responsibility harder to locate.
Source
TechCrunch, “Inforcer raises $50M to help prepare smaller businesses for a new world of AI and security risks,” July 30, 2026: https://techcrunch.com/2026/07/30/inforcer-raises-50m-to-help-prepare-smbs-for-a-new-world-of-ai-and-security-risks/