About Keywicket

Keywicket helps IT managers at organisations of up to 1,500 people see where identity risk is building up in Microsoft 365 and Google Workspace, and what to do about it.

Why it exists

Most breaches start with an identity: a phished admin, a forgotten account, an app with far more access than it needs. The tools that report on these risks often need premium licences, cover one platform, or are built for large security teams. Many organisations run Microsoft 365 and Google Workspace side by side and never see the whole picture.

Keywicket gives a plain-English view across both platforms, with fixes you can act on and references to the Essential Eight, ISO/IEC 27001 and SOC 2 that make sense to Australian and New Zealand organisations.

Read-only, always

A security tool shouldn't be a new risk. Keywicket asks only for read permissions, and its code is built so it can't send anything other than read requests to Microsoft or Google. That makes it easy to approve, and it means every change in your tenant stays your decision. How that's enforced.

Who runs it

Keywicket is operated by Keywicket Operator [placeholder entity name] (ABN to be confirmed), based in Brisbane, Queensland, Australia. It's built by an identity and access management practitioner.

Preview status

Keywicket is a self-service preview. It's free, it may change, and there's no live support team. Questions go to keywicket@vdbs.net and are answered when possible.