SVC/02 · Security
Tested, not assumed.
A security program sized for small and mid-size businesses, and independent penetration testing when you need proof.
01Security program
The protections that stop real attacks.
Most small-business breaches start in a few predictable places. We close those first, then keep them closed.
Accounts & access
Strong sign-in protection for every account, and admin access only for the people who need it.
Devices
Every laptop and phone protected, encrypted and kept to a consistent standard.
Email
Your domain protected against impersonation, and phishing stopped before it reaches the inbox.
Backups
Backups kept safely apart from your systems, and proven by regular test restores.
People
Practical training on the threats your team actually sees, reinforced with realistic drills.
Incident response
A written plan and a rehearsal, so everyone knows what to do before it matters.
02Evidence
A report, not a reassurance.
Regular reporting shows where you stand, what changed and what's next, in language leadership can act on.
| Check | Result | Status |
|---|---|---|
| MFA coverage | 42 of 42 accounts | Pass |
| Backup restore test | Restored 12 Sep, 14 min | Verified |
| Patch compliance | 38 of 41 devices | Patch due |
| DMARC policy | p=reject | Enforced |
| Phishing drill | 3 clicks, 0 credentials | Trained |
| Admin roles | 1 standing global admin | Action |
Move the standing global admin to just-in-time access. Scheduled for the next change window.
03Penetration testing
When the systems need testing too.
Independent, authorized testing of your network, applications, people and AI systems.
Authorized · hands-on · retest included
PT/01
Network & Microsoft 365 testing
What an attacker can reach from the internet, how far they could get once inside, and how well your accounts hold up.
PT/02
Web application testing
Your customer portals, web apps and integrations, tested by people trying to make them do what they shouldn't.
PT/03
Social engineering
Realistic phishing, phone and text campaigns that show how your team responds, followed by training aimed at what worked.
PT/04
AI system testing
The chatbots, copilots and AI assistants you've deployed, tested for what they could be talked into revealing or doing.
04How it runs
Scope to retest.
01
Scope
We agree what's in, what's out and what success looks like.
02
Authorize
Written authorization and ground rules before any testing begins.
03
Test
Experienced, hands-on testing within the agreed window.
04
Report
A leadership summary, clear findings and a prioritized plan.
05
Retest
We confirm the fixes, so the engagement ends with issues closed.
05Included
Every engagement includes.
Written by the person who did the testing.
See a sample reportA clear, written report
A summary for leadership, then each finding with evidence, a severity rating and a fix your team can act on.
Critical findings, same day
If we find something critical, we call you that day instead of waiting for the report.
Retest included
Once fixes are in, we retest at no extra cost and update the report with what's closed.
Attestation letter
A one-page summary of scope, dates and outcome for customers, auditors and insurers.
Readout call
We walk your team through the results and agree what to fix first.
Your data, handled carefully
Test evidence stays encrypted and is deleted after the retest unless you ask us to keep it.
06FAQ
Common questions.
What's the difference between a vulnerability scan and a penetration test?
A scan lists known weaknesses, mostly by software version, and includes false positives. A penetration test has a person exploit and chain those weaknesses to show what an attacker could actually reach, and only reports what was proven.
We're a small business. Do we need a penetration test?
Often the security program comes first, because the basics close most real-world risk. A test makes sense once those are in place, or when a client, insurer or regulator asks for one.
Will testing disrupt our business?
Scope and rules of engagement are agreed in writing first, including testing windows and anything that's off limits. Nothing is tested without signed authorization.
Can you help fix what the test finds?
Yes. We can handle the fixes ourselves or work alongside your existing IT team or provider.
Do you work in regulated environments?
We have experience in PCI, CCPA and CJIS environments, and can help you meet the security requirements behind your compliance obligations.