A fixed-scope compromise assessment for any organisation, on any cloud. Read-only access, a live dashboard you can watch, a hardening checklist for everything we find, and a signed answer in7 to 35 days.
The absence of alerts is not evidence of anything. It is the most common reason an intrusion runs for months — and it is why we look at the artifacts instead of the dashboards.
Every engagement runs on the same access model, the same live dashboard and the same close-out. What changes is the question you need answered.
Is anyone inside right now — or was anyone, recently?
A full sweep of endpoints, identity, cloud, email and SaaS telemetry. Findings graded by confidence, every indicator listed, a reconstructed timeline where the evidence supports one, and a signed attestation of what was and was not examined.
If someone tried tomorrow, would we hold?
Controls scored against NIST CSF 2.0 and CIS Controls v8. Identity, backups, logging and response readiness reviewed against configuration, not opinion. One tabletop, a prioritised 90-day plan, and a board-ready summary.
Someone already did this. Did they get it right?
Not a review of their report. A complete re-analysis of the same environment, collected and examined independently, the way a second forensic examiner would. You get a written verdict: concur, partially concur, or do not concur.
A second opinion here is not a read-through of somebody else’s report with a different logo on it. It is a complete, independent re-analysis of the same environment, collected and examined the way a second forensic examiner would, and then a written verdict on their work.
We re-run the whole analysis, not the conclusion.
Same estate, same period, same read-only roles — collected by us, hashed by us, cited by us.
Our independent analysis reaches the same conclusion on the same scope. You now have one answer with two independent bodies of evidence behind it.
The conclusion holds, the scope does not. Something material was out of reach, or a control was assumed rather than tested. We state exactly where we differ and why.
We reach a different answer. Every disagreement is evidenced: the artifact, the timestamp, the log line. Written to survive being read by the other side and by a court.
Not a checklist of products. Each source answers a different question, and traffic that passes a control is not traffic a control approved.
Servers, workstations and laptops, down to filesystem metadata, registry hives, scheduled tasks, service creation and process execution remnants. Collected with a single-run collector that removes itself.
Question it answers: Was anything executed here that should not have been?
Active Directory and Entra ID, your IdP, privileged groups, delegation and ACL history, group membership drift, dormant accounts and every authentication event in the window.
Question it answers: Could one set of credentials reach everything?
AWS, Azure and GCP tenants: control-plane logs, identity federation, resource exposure, storage permissions, key material and egress. Configuration diffed against what the agreement says should be there.
Question it answers: What is reachable from outside, and who reached it?
The business-critical applications and data stores — mail flow rules, SaaS audit logs, VPN and remote access, DNS, proxy and firewall history. Almost never covered by a standard endpoint sweep.
Question it answers: Where would the data actually have gone?
The sweep works through your estate one system at a time. Each is collected with the platform’s own read-only role, its artifacts are hashed and logged, and the tile turns clear or flags a finding. The counters on this page are the counters on your dashboard.
When the report is signed the agreement closes and the purge begins. Personal, health and sensitive data are removed record by record, with a live count of what is left. Two things stay: the compliance log that proves what we touched and when, and your copy of the report.
You never saw what was touched, which privileges were used, or how far the scope really reached. “Clean” arrives without the evidence that would make it mean anything.
The work happens off-site, off-screen. Weeks later a summary arrives. Which systems were examined, and which were quietly skipped, is anyone’s guess.
Each system collected and every artifact taken appears in a read-only, append-only evidence log the moment it happens, with the host name and the hash.
Vendors ask for admin because it is easier and collection is faster. Nobody writes down which privileges were requested, or which were actually used.
The exact roles are written into the signed access schedule before we ask for them. Never admin, never a configuration change, never a write.
A one-line result with no statement of how far anyone looked, for how long, or how confident they are. It cannot be repeated, audited or defended.
Page one states how far we looked, for how long, how sure we are, and what was out of reach. Then it is signed by the examiner who did the work.
Collected artifacts sit in a vendor’s store for months, sometimes years, with nobody accountable for them and no record of what was removed.
PII, PHI and sensitive data are removed record by record the day the report is signed. What remains proves what we did and nothing more.
From the first click to the last day of dashboard access. It runs itself unless you want to talk — and when you do want to talk, the call is already in the calendar. Click any step to see what you would be looking at.
Choose a package and intake starts immediately. Odd shape? Book a 30-minute slot and a representative scopes it with you. The calendar invite lands in your inbox with a joining link.
We are about to touch your users, systems and data, so the MSA, the data processing addendum and the access and privilege schedule are real documents. They are also automated: generated from the scope, sent, signed, countersigned.
A single request for exactly the privileges the signed schedule names. Platform-native read-only roles, under accounts you issue, expiring when the engagement closes. No standing access, no new licences left behind.
Every system we touch and every artifact we collect appears in your read-only dashboard as it happens: progress, evidence, findings. Anything urgent is on the phone the same day it is confirmed.
We walk you through what we found before a single page is written. Severity agreed, questions answered, scope challenged. Nothing is locked until you have heard it explained by the person who found it.
The signed report states scope, result, confidence and what was not examined. It ships with the full remediation checklist: every finding turned into a specific, verifiable hardening step your own team can execute.
PII, PHI and sensitive data are removed from our stores, record by record, with a live count of what remains. The compliance log of who, what and when is kept for audit. Nothing else is.
Re-read the evidence log, export the findings and the checklist, show the board exactly what was examined and what was not. Then the dashboard closes.
A report tells you what is wrong. The checklist tells you what to do about each item, in what order, and how to verify it is actually closed. It is 64 items across six areas, it ships with the report rather than as a paid extra, and you keep it whether or not you engage us again.
Dormant accounts, standing privilege, shared admin credentials and MFA on every remote-access path.
Critical patching, EDR coverage on the estate you had no visibility of, and undeclared remote tooling.
Public exposure, wildcard cross-account permissions, short-lived credentials and off-account log retention.
Inbox rules, external forwarding, third-party OAuth grants and immutable message tracing.
Audit coverage, off-host retention, and detections for the specific behaviours found here.
Immutable backups, tested restores, segmentation and where sensitive data actually lives.
Written to survive being read by a board, an insurer, an acquirer or the other side in a dispute. Your copy is yours; we do not hold it hostage to a renewal.
Written for a board or a regulator. The question asked, the answer given, the scope it covers, the confidence behind it, and what remains unresolved.
Every finding with the artifact it rests on: host, timestamp, hash, log line. No conclusion in the document that cannot be traced to evidence.
The full remediation checklist, turned into specific, verifiable steps. Sequenced, owned, and phrased so your own engineers can execute it without us.
What to do first, what it depends on, and what it removes. Effort against consequence, so the sequence is arguable rather than asserted.
Mapped to the frameworks your auditor, insurer or regulator already speaks
No standing access, no new licences left behind, no collector that outlives the engagement. The roles are written into the signed access schedule before we ever ask for them.
AWSSecurityAudit
Microsoft AzureReader · Security Reader
Google CloudViewer · Security Reviewer
Microsoft 365 / EntraGlobal Reader · View-Only Audit
Okta / Entra IDRead-only Admin
Google WorkspaceReports · read-only
EndpointsSingle run · non-persistent
On-premScoped at intakeFour numbers are enough to price it.
Scoping starts with a conversation, not a questionnaire you have to complete before anyone will talk to you.
Book the 30-minute call →Where we disagree with other assessors, who comes to us, whether this is the right call for you, and what the work usually turns up. Published because a buyer should not have to ask.
Stated up front so you can ask for it on the first call rather than at the end of an expensive engagement.
A clean report was a condition of the deal and nobody can say how it was produced.
You need a defensible answer on when data left, who took it and what was reachable.
Findings with no artifact reference cannot be defended, challenged or repeated.
A finding marked resolved, with nothing that changed on the system to show for it.
You need an examiner who did not work for the other side and whose conclusions cite the evidence.
You have a board, an insurer or an acquirer who will ask for evidence, and “our IT guy looked” is not going to be accepted.
You were told you are clean and you do not fully believe it. That instinct is usually correct.
A provider has already delivered a report and you need to know whether it was earned.
You have outgrown your ability to answer the question internally, and you do not want a three-year programme to find out.
You want the answer in weeks, with the evidence attached, and your data gone afterwards.
The call is with the person who would run the assessment. There is no salesperson in the loop and no discovery call before the discovery call.
Five patterns show up in most environments we examine.
The original response remediated the symptom. The access that enabled it, the credential it used and the gap it exploited are usually still there. This is the single most common thing we find.
Nobody broke in. A dormant service account with standing privilege, a nested group nobody audits, a token that outlived the user. No alert fires, because from the logs it looks like a normal login.
A tester account, a tool on a jump host, an SSH key from an engagement two years old. Common in organisations that have never been assessed independently, and routinely mistaken for our own activity.
Sessions that never crossed a monitored boundary, activity in systems with no logging enabled, or egress over a channel nothing was watching. Absence of alerts, absence of evidence.
The systems that hold the data have no endpoint agent, no log shipping and no retention — so no conclusion can be reached about them. We state that as a gap rather than quietly implying a clean result.
Patterns across engagements, not a description of any one client. Published because a buyer is entitled to know roughly what a report contains before commissioning one. A clean assessment is a real outcome and it is worth having — it is the evidence that your posture is doing what you paid for it to do.
Pick the size that matches what you need on the call and intake starts the same day, or describe something unusual and we will scope it together first. Either way you get the number in writing before any access is requested — and it does not move afterwards.
One segment, one cloud, one question. For teams that need an answer, not a programme.
Endpoints, identity, cloud and email as one sweep. The default for a first assessment.
Multiple tenants, business-critical applications and OT segments, sequenced by risk.
Something unusual, regulated, or larger than anything on this page. We work out the shape of it together on the call, and you get the number in writing before anything starts.
Pick a day and a slot in your time zone. The invite goes to your email, and the agreements follow only after you have read them. If something is actively wrong right now, say so on the call and we will treat it as an incident, not a sales conversation.