Security monitoring for Microsoft 365 & Defender
Kagemori turns Microsoft Defender's incidents, alerts, devices, vulnerabilities and Secure Score into one ranked list for your engineers and a plain-language report for each customer's management. It is read-only and multi-tenant, and you can resell it under your own brand.
| Customer | Risk | Incidents | Zero-days | Secure Score | Status |
|---|---|---|---|---|---|
| ▾ Manufacturing3 customers · 1 needs attention | |||||
| Northwind TradersPartner: Bayside IT | 74 | 3 | 2 | 48% | Needs attention |
| Fabrikam IndustriesDirect | 27 | 0 | 1 | 66% | Healthy |
| ▾ Retail & services3 customers | |||||
| Contoso RetailPartner: Bayside IT | 49 | 1 | 0 | 58% | 1 source issue |
| Tailspin LogisticsDirect | 12 | 0 | 0 | 79% | Healthy |
| Wingtip ClinicsDirect | — | — | — | — | Awaiting consent |
Built on signals your customers already pay for
KAGEMORI 影守 · guardian in the shadows
What is Kagemori?
Kagemori is a security monitoring service for businesses that run on Microsoft 365. It watches the alerts, devices, vulnerabilities and sign-ins that Microsoft Defender already collects, across many companies at once. It tells your team what needs action, explains to management what it means, and stays quiet the rest of the time.
The name is Japanese. We chose it because it describes, in two characters, the kind of protection we believe in.
The mark is a shield drawn from a single ribbon. It folds from cool cyan light into warm red-orange shadow: the quiet watch, and the moment Kagemori speaks up. The red-orange returns in the KAGEMORI wordmark, where the A becomes a watch-point with no crossbar. Monitor. Protect. Resolve.
The meaning of 影守
影Kageshadow · light
In everyday Japanese, 影 means shadow: the shape something leaves where it stands out of the light. In older and poetic Japanese the same character also means light itself. 月影 tsukikage is moonlight.
So kage holds both ideas: something that stays out of sight, and the soft light that lets you see in the dark. That is why our logo is drawn in two lights.
守Moriprotect · keep · watch over
守 is the character in 守る mamoru, to protect, and in お守り omamori, the small charms from shrines that people carry every day for protection.
Read as mori, it names a keeper: 灯台守 tōdaimori is a lighthouse keeper, and 子守 komori is someone who looks after a child. It describes a person whose job is to keep watch, so that others can rest.
Japanese has words for a kind of care that works without being seen. Three of them guide how we build Kagemori.
見守る
mimamoru · to watch over
Literally "to see and protect". It means watching over someone attentively without interfering, and stepping in only when they need you, the way a parent watches a child learn to walk.
In Kagemori: read-only access. We watch everything and change nothing.
縁の下の力持ち
en no shita no chikaramochi · the strength beneath the floor
A saying for someone whose work holds everything up while no one sees it, like the beams under a house. In Japan it is a compliment, not a complaint.
In Kagemori: monitoring that runs day and night so your team and your customers can focus on their work.
黒子
kuroko · the one dressed in black
The stagehands of kabuki and bunraku theatre, dressed in black from head to toe. The audience agrees not to see them, yet the performance depends on them.
In Kagemori: white-label by design. Our partners take the stage; Kagemori works behind them.
影で見守り、必要な時に灯をともす。
We watch over you from the shadows, and light a lamp only when you need to see.
Our direction
Large enterprises have security operations centres. Most small and mid-sized companies have a Microsoft 365 licence full of security data that nobody has time to read. We are building Kagemori so the managed service providers who look after those companies can watch them properly, explain risk in plain language and sell that as a service.
Read-only access, the fewest permissions possible, and nothing that can change a customer's tenant. A monitoring tool must never become the risk.
Every screen and report answers "what happened, does it matter, what do we do". Technical detail is one click away, never in the way.
Multi-tenant from the first line of code, white-label throughout, and priced so that a partner can build a profitable service on it.
Where we are heading · planned, not yet available
Why Kagemori
Microsoft gives every tenant excellent security data, but it is spread over many pages, one tenant at a time. Kagemori gives each audience what it needs from that data.
For your engineers
Start each day with what matters most across all customers, without switching tenants or rebuilding filters in the Defender portal.
For your customers' management
Risk in plain words, mapped to the NIST Cybersecurity Framework, with the decisions management needs to make this month.
For your business
Partners, customers and folders, with your logo and colours. Set it up once, onboard customers in minutes and bill monthly.
Features
Multi-tenant portfolio
Model your real business. You sit at the top, resellers and regional partners sit under you, and their customers sit under them, as many levels deep as you need. Each partner sees only its own customers.
Threats, ranked
Kagemori reads incidents, alerts and failed sign-ins from Microsoft Defender and Entra ID every few minutes and ranks them. Response still happens in Defender, one click away, so nothing is duplicated and Microsoft stays the source of truth.
Example data.
Zero-days in the wild
Kagemori checks the vulnerabilities on every device against CISA's catalogue of Known Exploited Vulnerabilities and FIRST's exploit prediction scores. When a new match appears, it alerts once per customer and names the affected devices.
CVE-2023-36884Known ransomware useIn CISA KEVOffice and Windows HTML remote code execution. Exploited in targeted phishing campaigns.
Example data. The CVE is real; the devices are fictional.
Posture
Microsoft Secure Score with industry and peer comparison, Defender exposure and configuration scores, and trends you can show in a quarterly review.
Alerts
Telegram messages for what is genuinely urgent, with deduplication, an immediate update when severity rises, and reminders until the item is resolved in Defender.
Threat intelligence
A daily briefing from the Microsoft Security Blog, Microsoft's security update guide, SANS ISC, The Hacker News and Krebs on Security, next to the zero-days that affect your customers.
White-label
Logo, accent colour and product name for every partner. Their customers see their brand on the console, in emails and on every PDF.
Licence-aware
If a customer lacks Defender for Endpoint, Defender XDR or Entra ID P1, Kagemori says which licence is missing and what it would unlock. That makes it a natural upsell conversation.
Accountability
Sign-ins, changes, exports, reports and every alert message are recorded and attributed to an organisation, for your ISO 27001 or SOC 2 evidence.
How it works
Your customer's IT administrator approves read-only access on Microsoft's own consent screen, and Kagemori takes it from there.
Enter a name, choose a partner and folder, and Kagemori creates an onboarding link. Send it yourself or let Kagemori email it.
About 1 minuteThe customer's Global Administrator signs in to Microsoft and approves the read-only permissions listed below. The link works for 14 days.
About 2 minutesIncidents, devices, vulnerabilities and scores start arriving within minutes. Alerts and monthly reports run automatically after that.
First data in minutesManagement reporting
Each month every customer receives a branded PDF that tells management how exposed they are, what changed and what they need to decide. It is backed by the frameworks their auditors and insurers already use.
Security and trust
A monitoring tool should never become the weakest link in a customer's tenant. Kagemori asks Microsoft for the smallest set of permissions it needs and nothing that could change data.
| Permission | What Kagemori reads |
|---|---|
| Microsoft Graph | |
| SecurityIncident.Read.All | Defender XDR incidents |
| SecurityAlert.Read.All | Security alerts |
| SecurityEvents.Read.All | Secure Score and security events |
| Score.Read.All | Secure Score history |
| AuditLog.Read.All | Failed sign-ins, for spray detection |
| Defender for Endpoint | |
| Machine.Read.All | Devices, health and risk |
| Vulnerability.Read.All | Vulnerabilities per device |
| SecurityRecommendation.Read.All | Hardening recommendations |
Never requested: write, isolate, remediate, mail, files or directory permissions. Kagemori cannot change anything in a customer's tenant.
Pricing
No setup fees and no per-device counting. Every plan includes onboarding help and the full feature set for each tenant.
For a single company or a group of related companies that wants its own security view.
Contact usPer tenant, per month
For managed service providers who resell monitoring to their customers.
Contact usPer tenant, per month · volume tiers
For large groups and regulated organisations with specific hosting or reporting needs.
CustomAnnual agreement
Questions
No. Kagemori only receives read-only permissions, listed in the Security section above. It cannot isolate devices, change settings, read mailboxes or files, or alter users. An optional, separate add-on can close alerts from inside Kagemori, but it is off by default, needs its own approval and asks for a two-factor code for every action.
Kagemori works with any Microsoft 365 business or enterprise plan and shows what each tenant's licences allow. Device and vulnerability data needs Microsoft Defender for Endpoint (included in Microsoft 365 Business Premium and E5). Incidents need Microsoft Defender XDR, and sign-in monitoring needs Entra ID P1. When a licence is missing, Kagemori says so plainly instead of showing an error.
No. Kagemori reads from Microsoft's cloud APIs. If your devices are already onboarded to Microsoft Defender, there is nothing else to deploy.
Defender is where analysts investigate and respond, one tenant at a time. Kagemori sits above it: one ranked view across all your tenants, zero-day matching against CISA KEV, partner hierarchy and white-labelling, and management reports mapped to NIST CSF 2.0. Every item links straight back to Defender for response.
Yes. Each partner can have its own logo, colours and product name. Their customers see the partner's brand in the console, in onboarding emails and on every report. Partners manage their own customers and users, and they cannot see anyone else's.
Delete the customer in Kagemori and remove the Kagemori app under Enterprise applications in Microsoft Entra. Access ends immediately. On request we delete the customer's archived data.
See Kagemori with your own Microsoft 365 tenant in a 30-minute demo. Connect a test tenant during the call and see real data before it ends.