About Orah Security
"Orah" comes from a Hebrew word meaning light. That's the idea the company is built on: shining light on the security blind spots that small and mid-sized businesses can't always see on their own — and that most security vendors don't bother to explain.
Enterprises have security teams, budgets, and tooling to see their risk clearly. Small and mid-sized businesses are told to care about security but rarely given the clarity to know what actually matters. Orah exists to close that gap — enterprise-grade visibility, sized and priced for companies that don't have a security team of their own.
Practitioner-led
Orah Security is founded and run by a working security engineer with hands-on enterprise experience in identity security, privileged access management (PAM), and CIS Controls-based auditing — not a sales organization reselling someone else's methodology. Assessments are built on recognized frameworks (CIS Controls v8, the CIS M365 Foundations Benchmark, and NIST CSF 2.0) so findings hold up with auditors, insurers, and customers.
Orah is also building proprietary assessment tooling for Microsoft 365 environments, aimed at making assessments faster, deeper, and repeatable. It's in development — this site will be updated as it's ready for clients.
Values
Clarity
Security findings should be understandable, not buried in jargon. Every report is written so a business owner can act on it.
Honesty about risk
No fear-mongering, no inflated findings to justify a bigger contract. Just an accurate picture of where you stand.
Doing the work
A report that sits in an inbox doesn't reduce risk. We stay through remediation, not just the findings phase.
Want to know where your business actually stands?
Start with a cyber risk assessment — a clear, framework-anchored picture of your risk.