© GEMXIT
Develop IT. Protect IT.
GEMXIT
Real-world capability. Not just services.
GEMXIT brings together Microsoft security, Azure architecture, training and development to solve real problems — improving visibility, reducing risk and delivering systems that actually hold up under pressure.
Stop Azure cost blowouts and security gaps
Azure environments that are secure, controlled and cost-efficient — with governance, visibility and architecture that actually make sense.
👉 Deep dive: Cloud Services
See what your environment is not telling you
Identity, endpoint and cloud security built around visibility — uncovering real activity using Defender, Sentinel and Entra ID, not just relying on alerts.
👉 Deep dive: Cyber Security
Build capability that actually sticks
Microsoft-aligned training built from real environments and real incidents — helping your team gain skills they can apply immediately, not forget next week.
👉 Deep dive: Training
Microsoft credentials & recognition
Proven capability across Microsoft cloud, identity, security operations, administration, AI and training, backed by recognised certifications, renewed Microsoft expertise and real-world delivery experience.
Security, Identity & Training Leadership
Microsoft Certified Trainer | Top 100 (Nominated 2024 & 2025)
Global Recognition | Top 100 of 22,000+ MCTs Worldwide
Nominated for the Microsoft MCT Top 100 in 2024 and again in 2025, this recognition places me among the top 100 trainers globally out of more than 22,000 Microsoft Certified Trainers worldwide.
Through GEMXIT PTY LTD and GEMXIT UK LTD, the focus remains simple: practical skills, measurable outcomes, and training that works beyond the classroom.
Microsoft TSP
July 2025As a Microsoft Training Services Partner (TSP), GEMXIT PTY LTD delivers Microsoft-certified training backed by real-world engineering experience. Every course is grounded in practical deployment scenarios, security-first design principles and measurable outcomes, bridging the gap between certification theory and operational capability.
Identity and Access Administrator Associate
February 2026We architect and secure identity platforms using Microsoft Entra ID, implementing Conditional Access policies, multi-factor authentication, privileged access management and governance controls. By embedding Zero Trust design principles and strong access lifecycle management, we help organisations strengthen their security posture while maintaining operational agility.
Microsoft Certified: Security Operations Analyst Associate
Renewed May 2026Advanced threat detection, investigation and response capability across Microsoft Defender XDR, Microsoft Sentinel and Microsoft cloud identity telemetry. This certification focuses on real-world security operations using KQL, behavioural analysis and incident investigation techniques to uncover suspicious activity that traditional alerts and dashboards often miss. Areas of focus include identity compromise detection, endpoint telemetry, email threat analysis, cloud investigation workflows and operational response across Microsoft security platforms. The renewal reinforces continued capability in modern Microsoft threat hunting and security operations practices.
Microsoft Certified: Azure Security Engineer Associate
Renewed June 2026 | Valid until December 27, 2027Demonstrated capability in securing Azure environments across identity, platform protection, network security, data protection and security operations. This renewal reinforces current expertise in Microsoft Defender for Cloud, Microsoft Sentinel, Microsoft Entra ID, Azure Key Vault, Private Link, Azure Bastion, web application protection, storage security and secure cloud governance. The certification supports GEMXIT's security-first approach to designing, protecting and monitoring modern Microsoft cloud environments.
Cloud Architecture & Modern Workplace
Information Security Administrator
March 2026Advanced data protection and compliance across Microsoft 365, focusing on safeguarding sensitive information throughout its lifecycle. This certification demonstrates expertise in Microsoft Purview, including Data Loss Prevention (DLP), Information Protection, Insider Risk Management and eDiscovery. Emphasis is placed on identifying data risks, applying classification and protection policies, and implementing real-world controls to prevent data leakage and insider threats. Designed to align security with business operations, ensuring organisations can protect their most critical asset... their data.
Microsoft Certified: Azure Administrator Associate
Renewed July 2026Demonstrated capability in administering Azure environments across identity, governance, compute, storage, virtual networking, monitoring and business continuity. This renewal confirms current practical knowledge of Azure App Service, virtual machines, storage security, network security groups, service endpoints, Azure Backup, availability and Microsoft Entra administration. It supports GEMXIT's continued delivery of secure, reliable and well-governed Microsoft cloud solutions.
Azure Solutions Architect Expert
February 2026Designing secure, scalable and cost-optimised Azure architectures across identity, networking, compute and storage. This certification reflects deep capability in translating business requirements into resilient cloud solutions, balancing performance, governance, security posture and operational efficiency. From hybrid environments to enterprise-scale deployments, every design prioritises reliability, clarity and long-term sustainability.
Microsoft 365 Certified: Administrator Associate
February 2026End-to-end Microsoft 365 administration across Exchange Online, SharePoint, Teams, Intune and compliance frameworks. Focused on building secure, productive and well-governed environments that empower users without compromising protection. Identity management, device compliance, information protection and collaboration architecture are delivered with a strong security-first mindset.
Built in the real world.
Not just designed for it.
GEMXIT was founded in Australia in 2006 with a simple idea: technology should be clear, secure and actually work in real environments.
Not over-engineered. Not over-promised. Just delivered properly.
Today, GEMXIT supports organisations across Australia and the United Kingdom across cloud, cybersecurity, training and development — with a focus on Microsoft security, real visibility and practical outcomes .
Led by Jonathan Foskett , a Microsoft Certified Trainer ranked in the Top 100 globally (2024 & 2025) , GEMXIT brings together deep technical expertise with hands-on experience across real deployments, real incidents and real business environments.
This isn’t theory-led consulting.
It’s built on what actually happens in production.
Years in the Field
Since 2006 | Australia → UKBuilt over two decades of hands-on delivery across small business, enterprise systems and high-trust environments. Long-term relationships. Consistent results.
Security That’s Actually Applied
Identity • Cloud • DetectionSecurity isn’t added later. It’s built into identity, access, infrastructure and monitoring from the start — using Microsoft Defender, Sentinel and Entra ID.
Visibility Over Assumptions
KQL • Threat Hunting • Real SignalsMost environments already have the data — they just don’t see it. GEMXIT focuses on uncovering what’s actually happening, not just what tools report.
Capability, Not Just Delivery
Microsoft TSP | Real-World TrainingTraining is built from real environments, real incidents and real workflows — helping teams build skills they can actually use.
Trusted platforms & strategic alignment
Built around established platforms, recognised ecosystems and trusted industry relationships that support secure, modern delivery.
Agent Foskett
Microsoft Security Investigation Hub
A rapidly growing Australian Microsoft Security investigation and learning library, built around the same investigative thinking used when reviewing real client environments. Explore 200+ Academy lessons, 110+ investigations and briefings and 350+ Microsoft security resources covering Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Cloud, Microsoft Entra ID, Microsoft Security Copilot, email security, endpoint telemetry, KQL threat hunting and cloud investigation workflows.
No alert triggered... but the data told a different story. Follow the evidence through practical investigations, operational lessons and Microsoft Security learning paths.
Latest from Agent Foskett
Recent investigations, Friday Cyber Briefings and practical Microsoft Security lessons from the expanding GEMXIT knowledge library.
Australian cyber security guidance applied in the real world
GEMXIT participates in
ASD’s Cyber Security Partnership Program
and aligns its security approach with guidance from
ASD’s Australian Cyber Security Centre,
including the
Essential Eight mitigation strategies.
Current government guidance, security advisories and recognised
cyber security practices are translated into practical controls
using Microsoft Defender, Microsoft Sentinel, Microsoft Entra ID
and Microsoft cloud security technologies.
Rather than treating cyber security frameworks as compliance
exercises, GEMXIT applies them according to each organisation’s
risks, systems, regulatory obligations and operational environment.
The focus includes identity protection, attack-surface reduction,
vulnerability management, security visibility, governance and
incident response capability.
Most environments do not fail because security products are missing.
They fail because controls are incomplete, inconsistently applied
or never properly tested.
👉 The objective is simple: reduce measurable risk, strengthen
resilience and provide evidence that controls are working.
Essential Eight maturity
Assess and progressively improve application control, patching, Microsoft 365 security, MFA, administrative privilege, operating-system hardening and backup controls against an appropriate target maturity level.
Identity is the control plane
Strengthen authentication, Conditional Access, privileged access and identity monitoring with Microsoft Entra ID, because modern attacks frequently begin with a compromised identity.
Detection and visibility
Use Microsoft Defender and Sentinel to correlate identity, endpoint, email, application and cloud activity—focusing on behaviour, attack paths and investigation rather than isolated alerts.
Risk and governance
Identify critical assets, business risks, regulatory obligations and control gaps before creating a prioritised and defensible cyber security improvement roadmap.
Resilience and response
Go beyond prevention by improving logging, investigation, incident response, recovery planning and the ability to continue operating when a security incident occurs.
Built for real environments
Balance security, regulatory expectations, usability, cost and operational reality rather than introducing controls that look impressive but cannot be maintained.
Microsoft Security investigations, Academy lessons and KQL guides
Explore practical Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Defender for Cloud and Security Copilot resources built around real investigation workflows. Follow identity, email, endpoint and cloud evidence from the first alert through to understanding what actually happened.
Popular Microsoft Security learning paths
Defender XDR Threat Hunting
Investigate activity across endpoint, identity, email and cloud signals using practical Advanced Hunting queries and repeatable investigation workflows.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "cmd.exe", "mshta.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine
| order by Timestamp descEmail Investigation
Trace suspicious messages through sender details, authentication results, delivery action, URLs and post-delivery activity in Microsoft Defender.
EmailEvents
| where Timestamp > ago(7d)
| project Timestamp, NetworkMessageId, SenderFromAddress,
RecipientEmailAddress, Subject, DeliveryAction
| order by Timestamp descEndpoint Process Investigation
Follow process trees, command lines, parent-child relationships and network activity to understand suspicious endpoint behaviour.
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe")
| where FileName in~ ("powershell.exe", "cmd.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName,
FileName, ProcessCommandLineEntra Sign-in Investigation
Investigate sign-in failures, unusual locations, authentication methods, Conditional Access outcomes and identity risk.
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType != 0
| summarize Failures = count() by UserPrincipalName,
IPAddress, ResultDescription
| order by Failures descMicrosoft Sentinel Operations
Build practical detection, investigation and response workflows across analytics rules, incidents, entities, workbooks and automation.
SecurityAlert
| where TimeGenerated > ago(7d)
| summarize AlertCount = count()
by AlertName, AlertSeverity, ProviderName
| order by AlertCount desc
| take 20Defender for Cloud
Learn cloud security posture management, workload protection, regulatory compliance, recommendations, attack paths and cloud investigation workflows.
AzureActivity
| where TimeGenerated > ago(7d)
| where ActivityStatusValue =~ "Failure"
| project TimeGenerated, Caller, OperationNameValue,
ResourceGroup, ActivityStatusValue
| order by TimeGenerated descMicrosoft Security Copilot
Learn how to use prompts, sources, sessions, plugins and investigation workflows to support analysts without replacing evidence-based decision-making.
Prompt objective:
Summarise the incident timeline.
Identify affected users and devices.
List the evidence supporting each conclusion.
Recommend the next investigation actions.Email Authentication Analysis
Understand SPF, DKIM and DMARC results, sender mismatches and why some suspicious messages may still reach a mailbox.
EmailEvents
| where Timestamp > ago(7d)
| where AuthenticationDetails has_any
("spf=fail", "dkim=fail", "dmarc=fail")
| project Timestamp, SenderFromAddress, Subject,
AuthenticationDetails
Let’s find what your environment
is not showing you.
If you want real visibility, not just dashboards and reports, let’s run a practical security review and see what is actually happening.
GEMXIT operates across Australia and the United Kingdom, delivering Microsoft security reviews, Azure cloud services, Microsoft training and secure custom development.
Melbourne
(AU)
London
(UK)