Why start here
For a lot of small businesses, the incident that actually costs money isn't a break-in to the server — it's one convincing email asking for one payment. It needs no malware and no access to your network: just an inbox that can be impersonated or taken over, and a payment process that trusts email. That's a narrow problem, and there is a lot you can do to make yourself a much harder target.
Three layers
Your domain, harder to forge
We find every service that sends email as you, set up the right email-security settings for each, and take your domain's anti-spoofing protection step by step to full enforcement — so mail servers that check are told to reject email faking your exact domain, whether it's aimed at your staff, your customers or your vendors. Domains you own but don't send from are protected from misuse too.
Your mailboxes, harder to take over
Multi-factor authentication on every mailbox, the old sign-in methods that skip it switched off, automatic forwarding to outside addresses blocked, every mailbox checked for hidden rules, admin accounts separated, and the impersonation protection already in Microsoft 365 or Google Workspace turned on.
Your money, harder to talk out the door
A one-page rule: any change to bank or payment details is confirmed by phone, to a number already on file. A note to your vendors and customers that your details never change by email. A 30-minute briefing for whoever pays the bills — then a simulated request to check the process holds.
Then a year of watching
- A day-90 report — your before-and-after score, walked through together.
- A monthly email-security summary in your client portal.
- A quarterly review at months 6, 9 and 12 — a short written report and a 30-minute call.
- Outside-in checks every quarter — which of your top vendors could be impersonated to send you a fake invoice, look-alike domains registered against your name, and whether the logins of the people who move money have turned up in criminal data.
- 3 hours of consulting — including a second opinion, within one business day, on any payment request that feels off.
How it works
- Kickoff call. 45 minutes. We set up access to your email admin and your domain's DNS, and list everything that sends email as you.
- Days 1–14 — see who's really sending. Email reporting goes on and we run the outside-in checks. Nothing that affects your mail changes yet.
- Days 15–60 — your domain and mailboxes. Mail records set up for each sender, MFA on every mailbox, outside forwarding blocked, mailbox rules checked. Changes are scheduled with you.
- Days 61–90 — enforcement and payments. Full protection switched on once the reports say it's safe, the payment-change rule in place, the briefing, then the simulated request.
- Months 4–12 — watch and report. Monthly summaries, quarterly reviews, and your consulting hours whenever you need them.
The honest part: no one can promise an inbox will never be fooled — we reduce the risk; we can't make it disappear. Domain anti-spoofing protection tells receiving mail servers to reject email that fakes your exact domain; it does nothing about look-alike domains, or a vendor whose own mailbox has been hacked. That's why Gold doesn't stop at email settings: the payment-change rule puts a phone call between a convincing email and your money.
What Gold covers — and what it doesn't
Gold covers one email domain (plus up to three you own but don't send from), the mailboxes that send from it, and your payment process. There's nothing to buy — we configure the Microsoft 365 or Google Workspace you already have. One fee, paid up front before work begins; nothing auto-renews.
It isn't our full assessment. Devices, backups, detection, AI tools and browser security are part of Platinum, which starts with the full 36-control security assessment. Many businesses start with Gold and move up when they're ready.
Already have IT or an MSP?
Good — keep them. We complement your existing IT provider; we never replace them. Email and DNS changes are often made by your IT provider with us on the call — we bring the plan and verify the result.
Frequently asked questions
What is business email compromise?
It's when someone uses email to pose as you, one of your staff, or a vendor you pay — usually to get an invoice paid, bank details changed, or a paycheck redirected. It often involves no malware at all: just a forged or look-alike address, or a real mailbox that has been taken over.
How long does Gold take?
90 days of hands-on work, then monitoring and reporting through month 12. Gold is one fee, paid up front — the kickoff is scheduled once it's paid.
Will this block our real email?
It's designed not to. We first switch on reporting — which changes nothing about how your mail is delivered — to see every service that sends as you, set each one up properly, and only tighten enforcement step by step as the reports show your real senders are covered.
Do we need to buy anything?
No. We configure the Microsoft 365 or Google Workspace you already have, and we run the reporting tools ourselves.
Is Gold the same as your security assessment?
No. Gold focuses on the one risk that most often moves money: email fraud. The full 36-control security assessment also covers devices, backups, detection and AI tools, and it is where Platinum and Diamond begin.
See if your domain can be spoofed.
Tell us about your business and your email domain — we'll check it from the outside, free, and tell you what we find. Prefer to talk? Call (949) 802-4831, Mon–Fri 9am–5pm MT.