Albacore Cloud Suite: Environment, Remote and Protection

Albacore has developed a suite of intelligent, secure and reliable products: Albacore Cloud Environment (ACE), Albacore Cloud Remote (ACR) and Albacore Cloud Protection Policies. These offerings combine fully managed Microsoft 365 workspaces, secure remote access built on trusted devices (Zero Trust), and codified security baselines tailored to each customer.

Albacore Cloud Environment (ACE)

ACE is our premium, fully managed Microsoft 365, workstation and user support solution. In today’s world of cloud and web applications, ACE is designed to operate serverless, while still providing unlimited helpdesk support, proactive RMM, OS/application patching, endpoint detection and response (EDR), and a full suite of collaboration tools (Exchange, OneDrive, SharePoint, Teams).

Key inclusions

• Managed EDR, proactive remote management, and full OS & Office updating.
• Unlimited telephone/remote helpdesk, and onsite response, including swap-out of devices when required.
• Exchange with online archive and legal hold; Office apps on desktop/web/mobile; OneDrive user storage; SharePoint team sites; Teams for meetings, chat and channels.
• Azure AD administration with MFA enabled by default; optional Zero Trust connection via ACR.

Albacore Cloud Remote (ACR)

ACR provides Zero Trust–aligned remote access to internal resources (e.g., RDS or line of business apps) without exposing public gateways. ACR is an ACE addon, and is deliberately not sold on its own. This ensures that device compliance, conditional access and identity protections from ACE flow naturally into remote access.

How it works

Enforces the use of trusted, compliant devices before allowing access to company servers. If a device is not compliant or enrolled, access is blocked, even if the credentials are correct. This applies whether you are connecting to Albacore‑hosted infrastructure or to your own on‑premise hardware.

Typical use cases

Secure access to internal applications such as ASM Sequoia, Descartes BoxTop, Sage, MultiFreight, Sigma FM3, Fargo TOPS, and more, all from trusted devices without requiring any public-facing gateway.

Albacore Cloud Protection Policies

A family of security baselines; Basic, Standard and Premium, that define conditional access, MFA, device registration/enrolment, modern authentication, application protection, geo-controls and more. These policies are standardised but can be tailored to specific requirements.

Tiers at a glance

• Basic: provides multi‑factor authentication and secure Microsoft app access for essential protection.
• Standard: adds stronger device awareness and optional location‑based controls.
• Premium: delivers the highest level of security with strict device trust, advanced access policies, and enhanced data protection.

Security Impacts of the Products 

Trusted devices (Zero Trust) materially reduce breach risk 

Industry evidence shows that password + MFA alone is no longer sufficient due to token theft and push fatigue/social engineering attacks. Enforcing trusted devices adds a nonspoofable factor: even with the correct password and MFA code, attackers cannot sign in from their own hardware. 

Common Attacks

A widely publicised class of cyberattacks involves MFA bypass via session token theft. Attackers trick users into logging in on a fake website that mimics a legitimate login page. The user completes MFA (so MFA does work), but the attacker steals the session token issued afterwards. This token can then be replayed on the attacker’s machine to gain access to Microsoft 365 without needing the password or MFA again.

How this attack works 

• The victim logs into what appears to be a legitimate website, but is actually controlled by the attacker. 
• The victim completes MFA successfully. 
• The attacker captures the session token issued after login. 
• The attacker loads the stolen token into their own browser and is authenticated instantly — with no password or MFA challenge. 
• Because the attacker’s device is not trusted, device-based access controls are the only remaining defence. 

How this would have been prevented with Albacore’s Zero Trust model 

If the attacked organisation had applied device-based access requirements, the same model enforced by ACE, ACR, and Albacore Cloud Protection, the attack would have failed. Even with a valid session token: 

• Sign in from an unenrolled/unregistered device would be blocked by conditional access. 
• The attacker’s machine would fail device compliance checks. 
• Only trusted, compliant devices can access company resources, closing the door on the most common MFA Bypass method in use today. 

How ACE + ACR + Protection Policies Work Together 

• ACE: Identity, collaboration, device management, EDR and default MFA. 
• ACR: Extends Zero Trust to internal applications without public exposure, inheriting trusted device controls from ACE. 
• Protection Policies: Formalise and enforce access rules, conditional access, modern authentication and device requirements. 

Support Impacts of the Products 

Lower friction for users, higher assurance for IT 

• Unlimited support within ACE removes the fear of “generating tickets”, helping users stay focused on their day today work rather than worrying about IT issues. 
• Standardised policies make troubleshooting clearer and faster, improving resolution times. 
• ACE’s EDR tools and update baselines reduce incident frequency. 
• The ACE/ACR model improves resilience, reduces the attack surface and maintains strong performance for remote workers. 

By combining ACE (managed cloud workspace and support), ACR (trusted device, non-public remote access), and Albacore Cloud Protection Policies (codified, enforceable controls), organisations gain a cohesive Zero Trust posture that is practical to operate and proven in real-world conditions. 

This unified approach raises the barrier for attackers, simplifies support, and gives leadership confidence that their security baselines are documented, enforceable and auditable.