The range
Six assessments, one standard of evidence
Start with the Baseline. Go deeper where it shows a gap. Every finding is signed by our Fractional Security Director, and every assessment is a one-off fixed fee.
- Core
Baseline Security Assessment
Where your client stands across seven areas, each rated 1 to 5, with a roadmap you can sell.
- Who reads it
- Owner, director or board
- Best for
- Any client, as the first step
- Delivered in
- 3 to 5 business days
- Follow-up
- Two guided fix calls
- Tracking
- Your dashboard to track each fix
- Access
- Read-only. Changes nothing.
What's included
- Seven areas, each rated 1 to 5
- What nobody is watching
- Insurance and regulatory readiness
- Now, Next, Later roadmap
- Core
Technical Deep Dive
Seven days watching real traffic inside the network, with every weakness ranked by what an attacker would use first.
- Who reads it
- Your technical lead
- Best for
- The step after a Baseline
- Delivered in
- About 10 business days
- Follow-up
- Six calls over eight weeks
- Tracking
- Your dashboard to track each fix
- Access
- Temporary tools, removed after. Not a penetration test.
What's included
- 7 days of real traffic, observe only
- Internal and external scans, ranked by real risk
- CIS Controls v8 review
- Tickets ready to import into your PSA
- Add-on or standalone
Compliance Readiness Assessment
Evidence checked control by control against the framework your client needs, before the auditor arrives.
- Who reads it
- Whoever prepares for the audit
- Best for
- Regulated or supply-chain clients
- Delivered in
- 5 to 10 business days per framework
- Follow-up
- Four calls over six weeks
- Tracking
- Progress tracking included
- Access
- Preparation, not certification.
What's included
- Control-by-control status
- Evidence map: what exists and what is missing
- Audit preparation checklist
- Optional check before the formal audit
- Add-on or standalone
OT and IoT Assessment
Finds the building systems, cameras and plant equipment no one listed, and how far an attacker could get from them.
- Who reads it
- Your technical lead
- Best for
- Manufacturing, utilities and buildings
- Delivered in
- About 10 business days
- Follow-up
- Review call, or with a Deep Dive
- Tracking
- Progress tracking included
- Access
- Passive. Never touches the machines.
What's included
- Every connected device found
- What talks to what
- Vendor remote access
- A plan to separate office and plant safely
- Add-on or standalone
AI Security Assessment
Shows what AI is in use, what company data it could reach, and what to lock down first.
- Who reads it
- Owner, director or board
- Best for
- Any client using or planning AI
- Delivered in
- 3 to 5 business days
- Follow-up
- Review call, or with a Baseline
- Tracking
- Progress tracking included
- Access
- Read-only. Not AI strategy or legal advice.
What's included
- What AI is in use, approved or not
- What company data AI tools can reach
- What to lock down first
- Led by security, with no AI product to sell
- For your MSP
MSP Stack Review
A review of your own tools and processes, measured against the security you sell to clients.
- Who reads it
- Your leadership team
- Best for
- MSP owners and technical leads
- Delivered in
- 3 to 5 business days
- Follow-up
- 30-minute walkthrough
- Tracking
- Report and roadmap
- Access
- Read-only. No access to your clients.
What's included
- Your stack, mapped on one call
- Open gaps, by client segment
- Revenue left on the table
- Tool overlap you could consolidate
Add Compliance Readiness, OT and IoT or AI Security to a core assessment, or run any of them on its own. A 90-day re-score of the Baseline is available as an extra.
Step by step
What happens, step by step
Pick an assessment to see each step from scope to follow-up.
3 to 5 business days after access
Get started with Baseline- 1Discover
30-minute call
With you, to confirm the client and the scope.
- 2Access
Read-only access
Read-only consent per platform. Nothing is installed or changed.
Day 0
- 3Assess
Prepared and signed
Our AI prepares; our Fractional Security Director signs off.
- 4Release
Signed report
Under your brand, with your dashboard and PSA export.
3 to 5 business days
- 5Review
60-minute review
A review call with you.
- 6Improve
Guided fixes
Two guided fix calls. 90-day re-score available as an extra.