I've gotten more use out of Microsoft's "Security Score" to identify and advise on mitigation in my environment than most other "automated" options.
Paying a managed service to advise is also an option. I have heard Huntress is pretty good. I am sure there are others out there.