We find the holes before they do.
Most small-business breaches don't start with a genius hacker. They start with a spoofed invoice, a reused password, or a backup nobody tested. We find those gaps, close them, and prove they're closed, in plain English.
Six gaps. Six fixes.
These are the openings we see most often in small offices. Each one is cheap to close compared to what it costs when someone else finds it first.
Anyone can email "as" you
Missing email authentication lets a scammer send invoices that look like they came from your domain.
The fix SPF, DKIM and DMARC set up correctly, plus a phone-back rule for payment changes.
Passwords are the only lock
One reused or phished password opens email, files and banking. Insurers now ask about this first.
The fix Multi-factor sign-in on email, banking and admin accounts, and a password manager.
Backups nobody has tested
A backup that has never been restored is a guess. Ransomware often deletes the backups first.
The fix An offline or immutable copy, and a restore test you can see, on a schedule.
Old accounts still work
Former staff and vendors keep access to email, shared drives and software long after they leave.
The fix An account audit and a simple offboarding checklist your office manager can run.
Guests share your office network
Visitors, smart TVs and card readers on the same Wi-Fi as the computers holding client files.
The fix Separate guest and staff networks, and a firewall that's actually configured.
The website is the weak spot
Out-of-date plugins and forms without encryption leak customer details and get sites blacklisted.
The fix Updates, HTTPS everywhere, secure forms, and monitoring for changes.
From a free check to a full hunt.
Start small or go deep. Every engagement gets a written scope, plain-English findings, and proof of what changed.
Free Security Check
A no-touch review of what's already public: spoofable email, insecure forms, exposed details, and website health. One page, yours to keep.
Request yoursEmail & wire-fraud defense
SPF, DKIM and DMARC done right, lookalike-domain monitoring, and a payment-change verification routine your team will actually follow.
Cyber-insurance readiness
Get MFA, endpoint protection, tested backups and an incident response plan in place and documented, so the questionnaire is easy to answer honestly.
Account & access cleanup
Microsoft 365 or Google Workspace audited: who has admin, who left, what's shared publicly. Everything put back in your name.
Office network & Wi-Fi
Guest and staff networks split, firewall configured, remote access locked down, and devices you didn't know about found.
Website security
Admin accounts trimmed, plugins updated, security headers set, backups running, and monitoring that tells you when something changes.
Authorized pen testing
With your written authorization, independent partner firms test the same scope blind, and we cross-check their findings into one verified report.
How the blind cross-check works →vCISO
Security leadership without the full-time salary: a running plan, policies, vendor reviews, and someone to answer client and auditor questionnaires.
After-incident cleanup
Something already happened. We help contain it, recover accounts and data, find how they got in, and close that door for good.
Authorized. Tested. Proven.
Authorize
You sign a scope that says exactly what may be checked or tested. Nothing outside it gets touched.
Find
AI-assisted pre-checks, then human review and, where it fits, independent partner firms testing blind.
Fix
We close the gaps in order of what matters most to your business, and explain each one.
Prove
We re-test, show you the before and after, and hand you a plain-English record you can give an insurer or client.
Ready for what's next.
Data stolen today can be stored and decrypted later, once quantum computers are strong enough. Through vetted specialist partners, under confidentiality agreements already in place, we help you map where your business relies on encryption and plan the move to quantum-resistant standards. For anyone bidding on government work, that's becoming a compliance question.
Security questions.
Will you touch our systems?
Not without your written permission. The free security check only looks at what's already public. Any hands-on testing happens after you sign an authorization that says exactly what's in scope.
We handle patient or client financial data. Can you work with that?
Yes. We sign business associate agreements and NDAs, keep client data protected to the standard we sell, and only bring in partner firms who are bound by the same terms.
Our insurer sent a security questionnaire. Can you help?
That's one of our most common projects. We help you put the controls in place first, so you can answer honestly, and give you the documentation to back it up.
We already have an IT company. Do we need you?
Maybe not. We often work alongside an existing IT person or company as the independent security check. If your setup is solid, we'll say so.
Something already happened. What do we do right now?
Don't wipe anything yet. Change the password on your main email account from a clean device, call your bank if money moved, and contact us. We'll help you contain it and work out what was touched.
Judge us by what we find.
A plain-English look at what's publicly exposed for your business. Nothing touched, nothing to install, yours to keep even if you never hire us.