What you actually get
Most security assessments end with a hundred-page PDF nobody reads. Ours ends with a score, a short list of what to fix first, and a partner who sticks around to fix it. Deliverables:
- A scored baseline of your current environment — 36 controls across six security domains — so you can measure improvement instead of guessing.
- An executive summary written for owners and office managers, not engineers.
- A technical report your IT provider or MSP can act on directly.
- A prioritized 90-day roadmap — quick wins first, bigger projects scheduled realistically.
- Hands-on remediation — we don't just hand you the list; we work through it with you.
- AI Visibility & Browser Security for every employee, from onboarding on — which AI tools your team uses and with which accounts, plus protection against phishing and risky browser extensions. We manage it; you buy nothing and it never reads passwords, prompts or documents.
What we look at
Six domains, 36 scored controls, 1,000 points. Identity, email, and endpoints carry the most weight because that's where small-business incidents actually start — and five of the 36 are required controls every client has to pass.
Identity & access
Nine controls. Who can log into what, multi-factor authentication coverage, admin accounts separated from daily-use ones, legacy sign-in methods switched off, and whether ex-employees are really gone.
Email security
Seven controls. Phishing resistance, domain spoofing protections, and the Microsoft 365 mail rules attackers love to abuse — including the quiet auto-forwards that send your mail out the door.
Endpoint protection
Eight controls. Laptops and workstations: encryption, updates that actually install, screen locks, endpoint protection that reports somewhere, and what happens if one walks out the door.
Data protection & backup
Six controls. Where your sensitive data lives, who can reach it, how it's shared inside and outside the company — and whether a restore has ever been tested, not just scheduled.
Detection & response
Two controls. Audit logs switched on and kept long enough to be useful, and a one-page incident plan naming who to call, in what order, when the network is down.
AI governance
Four controls. Which AI tools your team uses and on which accounts, what those tools can read, whether anyone can connect a new one without approval, and whether staff have been told what's off-limits.
How it works
- Kickoff call. 45 minutes. We learn how your business runs and who manages your IT today.
- Discovery (weeks 1–2). Mostly read-only review of your configuration. Minimal interruption — most clients spend under three hours total with us during this phase.
- Report & roadmap. You get your score, the executive summary, and a prioritized plan. We walk through it together.
- Remediation (days 15–90). We implement the fixes — directly, or alongside your existing IT provider. Quick wins usually land in the first two weeks.
- Re-score. At the end of the engagement, we measure again so you can see the improvement in numbers.
The honest part: about 90% of what we recommend requires no new software purchases. If you're on Microsoft 365, you already own most of the security stack you need — it's just not turned on. Our job is configuration, not sales.
Only worried about email fraud right now? Gold covers just that — your email domain, your mailboxes and the way you approve payments — made much harder to abuse in 90 days and watched for a year, for one fee.
Who this is for
Businesses with 1 to 100 employees — typically dental and healthcare practices, professional services firms, and financial advisors. If you've ever thought "we're probably fine, but I honestly don't know," this assessment answers that question with evidence.
We're based in Lehi, Utah and work in person across Utah County, Salt Lake County, and Silicon Slopes — and remotely with businesses nationwide. If your practice handles patient data, see how we work with dental and healthcare practices.
Already have IT or an MSP?
Good — keep them. We complement your existing IT provider; we never replace them. They keep things running; we measure and harden security posture. Many engagements end with our roadmap being executed by the client's own MSP, with us verifying the results.
Frequently asked questions
What does the assessment include?
A scored review of 36 controls across six domains — identity and access, email security, endpoint protection, data protection and backup, detection and response, and AI governance — plus an executive summary, a technical report, and a prioritized 90-day roadmap.
How long does it take?
About two weeks for the assessment itself; under 25 employees is often 7–10 days. The full engagement, including remediation, runs 90 days.
Will it disrupt our work?
No. Discovery is mostly read-only. Nothing changes until remediation, and changes are scheduled with you.
Do we need to buy new software?
Almost never. The usual exceptions are a SaaS backup for Microsoft 365 and a password manager — each a few dollars per user per month.
What if our score is bad?
Most clients start low — that's the point of a baseline. It's a starting line, not a grade. The roadmap turns the score into a plan.
Related reading: What a small business cybersecurity assessment actually covers
Find out where you actually stand.
Tell us a little about your business and we'll get back to you soon. Prefer to talk? Call (949) 802-4831, Mon–Fri 9am–5pm MT.