Proof, not paperwork
Fixed-fee security assessments you can sell to your clients
Fixed-fee security assessments for your clients: live evidence from their own systems, a Fractional Security Director signature on every finding, and every fix tracked. Under your brand.
- Read-only
- Fractional Security Director sign-off
- Your brand
- One-off fixed fee
Rating by area
Seven areas, each rated 1 to 5
- 01Endpoint and identity2/5
- 02Network3/5
- 03Cloud and email3/5
- 04Detection and response2/5
- 05Exposure and operations4/5
- 06Operational technology1/5
- 07Reporting and compliance3/5
Why now
Your clients are being asked to prove their security
Insurers at renewal
Longer questionnaires, and cover that depends on the answers.
Customers and certifications
Supplier questionnaires and certification readiness.
The board
“Are we safe?” and an answer they can stand behind.
AI in the business
AI tools going live, and what they can see.
A ticked checklist no longer holds up. Clients need evidence from their own systems, and they will come to you for it first.
What is different
Live evidence, not questionnaires
- EvidenceTypical: Questionnaires and documentsLive settings from your client's own systems
- Sign-offTypical: Tool output, or no named reviewerA Fractional Security Director signs every finding
- What the client getsTypical: A PDF that goes in a drawerA signed report, a tracked roadmap and a progress dashboard under your brand
- IndependenceTypical: Often tied to a productAny tools, white-label, channel only
- How it is madeTypical: Weeks of manual workDays. Our AI prepares; our Fractional Security Director signs off.
Proof, not paperwork
Why MSPs choose it
No homework
Read-only access and one call. You don't run tools or read raw output.
Proof you can show
Every finding has its evidence and a Fractional Security Director signature.
Work you can sell
Every finding comes with a business reason and a fix you can quote.
Proof the work paid off
Track every fix in your dashboard. Add a 90-day re-score for a before and after.
Your brand, your stack
White-label, and it works alongside the tools you already run.
Our AI prepares; our Fractional Security Director signs off.
You sell it. You own the client. We deliver it behind you. We never contact your client.
The range
Six assessments, one standard of evidence
Two core assessments, three add-ons and one review of your own MSP. Each is a one-off fixed fee.
- Core
Baseline Security Assessment
Where your client stands across seven areas, each rated 1 to 5, with a roadmap you can sell.
3 to 5 business daysOwner, director or board
- Core
Technical Deep Dive
Seven days watching real traffic inside the network, with every weakness ranked by what an attacker would use first.
About 10 business daysYour technical lead
- Add-on or standalone
Compliance Readiness Assessment
Evidence checked control by control against the framework your client needs, before the auditor arrives.
5 to 10 business days per frameworkWhoever prepares for the audit
- Add-on or standalone
OT and IoT Assessment
Finds the building systems, cameras and plant equipment no one listed, and how far an attacker could get from them.
About 10 business daysYour technical lead
- Add-on or standalone
AI Security Assessment
Shows what AI is in use, what company data it could reach, and what to lock down first.
3 to 5 business daysOwner, director or board
- For your MSP
MSP Stack Review
A review of your own tools and processes, measured against the security you sell to clients.
3 to 5 business daysYour leadership team
How it works
One call from you, a signed report from us
- 01
Discover
30 minutes with you
- 02
Access
Read-only. Nothing is changed.
- 03
Assess
Our AI prepares; our Fractional Security Director signs off.
- 04
Release
Signed report under your brand, your dashboard, PSA export
- 05
Improve
Review call and guided fixes
Your client sees your brand at every step. A 90-day re-score is available as an extra.
Your dashboard
Track every fix in one place
You track every fix in your dashboard, and your client gets a progress dashboard under your brand, plus the signed report. Baseline Security Assessments and Technical Deep Dives have their own dashboard screens today.
Findings and roadmap
Ratings by area, ranked risks and the Now, Next, Later plan.
Track every fix
Mark each fix open, in progress or done.
Export to your PSA
Send the roadmap straight to your PSA, and use it in your QBRs.
Your brand, shared your way
Reports carry your brand, and so does the progress dashboard your client gets.
From report to revenue
Every proven finding is work you can sell
Each finding carries its evidence and a business reason, so your client sees why the work matters before you quote it.
- MFA not enforcedQuick-win projectProject
- Microsoft 365 not backed upBackup with an immutable copyRecurring
- Alerts reviewed in office hours only24/7 monitoring, with any providerRecurring
- Flat networkSegmentation projectProject
- Unlisted devicesBrought into managed scopeRecurring
Illustrative findings from a worked example. You set your own client price.
Standards
Standards we review against
The international frameworks apply wherever your client operates. Regional standards are added on top.
United Kingdom and Ireland
International
- NIST CSF 2.0
- ISO 27001
- CIS Controls v8
- Cyber-insurance questionnaires
- PCI DSS 4.0, where card data is handled
Regional
- Cyber Essentials and Cyber Essentials Plus readiness
- NIS2 (Ireland)
- DORA for financial services
- GDPR technical controls
Europe
International
- NIST CSF 2.0
- ISO 27001
- CIS Controls v8
- Cyber-insurance questionnaires
- PCI DSS 4.0, where card data is handled
Regional
- NIS2, including Belgium's CyberFundamentals framework
- DORA
- GDPR technical controls
- IEC 62443 for operational technology
- EU AI Act, where it applies
United States
International
- NIST CSF 2.0
- ISO 27001
- CIS Controls v8
- Cyber-insurance questionnaires
- PCI DSS 4.0, where card data is handled
Regional
- HIPAA Security Rule (reviewed on request)
- CMMC 2.0 (reviewed on request)
- DFARS (reviewed on request)
Australia
International
- NIST CSF 2.0
- ISO 27001
- CIS Controls v8
- Cyber-insurance questionnaires
- PCI DSS 4.0, where card data is handled
Regional
- Essential Eight (ACSC) readiness
A readiness review, not certification, and not a penetration test. Assessment vs pen test vs scan
Ready to offer your first assessment?
- One-off fixed fee
- Sized by the client
- You set your client price
- No ongoing commitment
Common questions
What is an MSP security assessment?
A fixed-fee review of your client's security, with evidence collected read-only from their own systems, signed by our Fractional Security Director and delivered under your brand. The Baseline rates seven areas from 1 to 5 and ends with a ranked fix plan.
How long does it take?
Baseline Security Assessment: 3 to 5 business days after access. Technical Deep Dive: about 10 business days, including 7 days of observation. Compliance Readiness Assessment: 5 to 10 business days per framework. OT and IoT Assessment: about 10 business days. AI Security Assessment: 3 to 5 business days. MSP Stack Review: 3 to 5 business days. Times are typical, not a guarantee.
Can I offer it under my own brand?
Yes. Reports and your client's progress dashboard carry your brand, and every call is with you. We never contact your clients.
Do you use AI?
Yes. Our AI prepares; our Fractional Security Director signs off. AI never rates or creates a finding on its own.
Can my client see progress?
You track every fix in your dashboard, and your client gets a progress dashboard under your brand. Your client also gets the signed report under your brand.
Do you change anything in my client's environment?
The Baseline is read-only and changes nothing. A Technical Deep Dive adds temporary observe-only tools that your team deploys and removes. Your team makes any changes, once your client approves them, and we guide you through each fix.
Which tools do you support?
It works alongside the tools you already run, with no tie-in. Major RMM, EDR, Microsoft 365 and Entra, and firewall platforms are covered. If a platform is not on that list, mention it when you get started.
Is this a penetration test?
No. It is a security assessment, not a penetration test. If your client needs one, it can be arranged separately.
What happens after the assessment?
Every Baseline includes two guided fix calls. You track each fix in your dashboard, and your client gets a progress dashboard under your brand. A 90-day re-score is available as an extra, as are guided remediation blocks and ongoing Fractional Security Director support.
Will enhanced.io contact my client?
No. enhanced.io does not contact the end client. Every call, including the review call, is with you.
Which standards do you review against?
The international frameworks that apply everywhere: NIST CSF 2.0, ISO 27001, CIS Controls v8, the controls cyber insurers ask about, and PCI DSS 4.0 where card data is handled. Regional standards are added on top. UK and Ireland: Cyber Essentials and Plus readiness, NIS2 (Ireland), DORA and GDPR technical controls. Europe: NIS2, DORA, GDPR and IEC 62443 for OT. United States: HIPAA, CMMC and DFARS, reviewed on request. Australia: Essential Eight readiness. It is a readiness review, not certification or a legal opinion.