Your security is probably fine. Probably is the problem.

Three ways to replace an opinion with evidence: starting with a free external scan that shows you exactly what an attacker can see from outside your business. Nothing is installed. Nothing is touched. You keep the report.

Book the FREE EXTERNAL SCAN

Free. Non-intrusive. No agents, no access to your systems.
One domain name is all we need to begin.
30-minute review call with an engineer, then it’s your decision.

See what the report contains
overline

The Problem

Consider using this if you need to provide more context on why you do what you do. Be engaging.

Nobody asks how secure you are until it’s inconvenient.

Then several people ask at once, and they all want the answer in writing.

1

A customer sends a security questionnaire, and nobody in the building can fill it in.

2

The insurer wants to know about multi-factor authentication and backups before it renews the policy.

3

A supplier contract now carries security clauses that were never there before.

4

Your provider says everything is fine, and you have no way of checking whether that’s true.

None of these is a technical problem. Each one is an evidence problem, you’re being asked to prove something that nobody has ever measured.

And the people best placed to measure it are usually the same people selling you the equipment. That’s not dishonesty. It’s a conflict of interest, and it’s built into how the market works. An architect surveys the site before anyone lays a brick, and doesn’t sell the bricks.

overline

Three questions

Consider using this if you need to provide more context on why you do what you do. Be engaging.

Three questions. Three ways to answer them.

Two assessments and one ongoing service. Each answers a single question properly, rather than answering all three vaguely. Most companies start at the outside, because it costs nothing and needs nothing from you.

The questions people ask before they book.

What can attackers see from the outside?

EXTERNAL ATTACK SURFACE

Every domain, subdomain, address and service you expose to the internet, including the ones nobody remembers setting up. The forgotten test site. The old mail record. The system a departed employee stood up in an afternoon.
Nothing internal is touched, so there’s no disruption and nothing to schedule.

BEST FOR:
A first assessment, or a baseline before a compliance conversation.

YOU RECEIVE:
An executive risk overview and a prioritised list of what’s exposed, worst first

How secure are we from the inside?

INTERNAL SECURITY POSTURE

We assume one account or one laptop has already been compromised, then measure how far that gets. Across identities, devices and configuration, the settings nobody has revisited since the day the tenant was created.
This is the assessment that tends to surprise people.

BEST FOR:
Growing companies, and anyone whose work has moved into Microsoft 365 or Google Workspace.

YOU RECEIVE:
A view of how far one compromised login travels, and a remediation plan in priority order.

Can we lock every door and detect a real attacker?

SECURITY AS A SERVICE · PLATFORM + MANAGED SERVICE

Locking the doors is the easy half. Noticing when somebody tries one is the half that gets skipped. The platform protects email, identities, devices and cloud data as one system, so an attack that moves between them reads as a single story rather than four unrelated alerts. Then somebody has to read what it says, and that can’t be nobody’s job.

BEST FOR:
Companies that have bought security tools and have nobody whose job is to look at them.

YOU RECEIVE:
Continuous protection and monitoring, a monthly report with a technical call, and a review with your management twice a year.

overline

The deliverable

Consider using this if you need to provide more context on why you do what you do. Be engaging.

A report your board can read without a translator.

Most security reports are written for the person who commissioned them, in the vocabulary of the tools that produced them. That’s how a serious spending decision ends up resting on a document three people in the company can follow.
Ours opens with a posture score set against the benchmark for your industry, so the first thing you see is where you stand rather than a list of findings. Every term used is explained in plain English at the back. Nothing is graded on a curve, and nothing is dressed up.

– Written for an owner, an MD or a finance director, not for an engineer
– Findings ranked by what they’d actually cost you, not by severity label
– Signed NDA before anything begins. The report is yours to keep
– A 30-minute call with the engineer who ran it, to go through what matters

An assessment is a survey, not a contract.

We work the way an architect does: survey the land, then decide what to build. Some clients take the report and hand it to their own team or their existing provider. Some ask us to carry on. Both are normal, and the first step commits you to neither.

1

Survey the land

Find out what’s actually there, and what’s visible from the road.
THIS IS THE FREE SCAN

2

Pour the foundation

Fix the things everything else depends on, in priority order.

3

Raise the walls

Put real protection around the people, the mail and the data.

4

Fit the alarms

Add the detection that tells you when something is wrong.

5

Keep watching

Someone monitors it, hunts for trouble, and responds when it appears.

This is built for you if

  • You have between 10 and 250 people and nobody who owns security
  • Your work lives in Microsoft 365 or Google Workspace
  • Customers, insurers or auditors have started asking questions in writing
  • You have an IT manager who needs senior backing to win a budget argument
  • Your board wants a second opinion it didn’t buy from the incumbent

It isn’t for you if

  • You want a cheaper quote for equipment you’ve already chosen
  • You want a report that confirms a decision that’s already been made
  • You need someone to run day-to-day IT — that’s your provider’s job, and we’re happy to work alongside them
  • You’d rather not know. It’s a fair position. This isn’t the page for it
overline

The questions people ask before they book

Consider using this if you need to provide more context on why you do what you do. Be engaging.

We charge for the work, the assessments, the advisory, the projects. Where we introduce a technology partner, we take a commission, and we disclose it. It’s flat, and it doesn’t change depending on which vendor you pick, so there’s no version of this where recommending one product earns us more than recommending another. If you want the figure before you start, ask and we’ll tell you.

You get a written report and a 30-minute call to go through it. After that it’s your decision, and quite a few clients take the report to their existing provider and get it fixed there. We’d rather be the firm you call in two years than the one you stop taking calls from in two weeks.

No. The external scan is non-intrusive and looks only at what’s already visible from the public internet. Nothing is installed, no agent runs on your machines, and we need no access to your systems. All we need to begin is a domain name. The internal assessment does need access, and that’s scoped and agreed with you in advance.

Then you found it before somebody else did, which is the entire point. We tell you straight away rather than saving it for the report, we put it at the top of the list, and we can coach your own team or your current provider through fixing it. The report is a survey of the building, not a judgement on whoever built it.

No, and most clients don’t. We sit above the day-to-day, in the seat a CIO would occupy setting direction, checking the work, and making sure the money goes where it should. Co-management is our normal working arrangement, and it tends to make a good provider look better, because someone is finally specifying what good looks like.

Forty people, a cloud tenant nobody has reviewed since it was set up, and no security lead is precisely the situation this was built for. Companies of that size carry the same exposure as much larger ones and have none of the in-house capacity to deal with it. The free scan exists so that the first step costs you nothing but the domain name.

Senior IT engineers and architects who came out of IT leadership, consultancy and cybersecurity roles in large corporates, supported by a vetted partner network for specialist work. The person who runs your assessment is the person who presents it to you.

An NDA is signed before anything starts. The report belongs to you, whether or not you ever work with us again.

Start with the outside view

It’s free, it’s non-intrusive, and it begins with a single domain name. You’ll have the report and a call with an engineer inside a week.

What you get: a written report on what your business exposes to the internet, ranked worst first, plus a 30-minute call to go through it.


What we need: a domain name and someone to send the report to.


What happens next: whatever you decide. There’s no contract attached.