Stop failing the security questions your clients, network and insurer ask.
Advice firms hold client ID, bank statements and pension details, and every renewal, network review and platform questionnaire now asks how that data is protected. We find the gaps, fix them, and give you evidence you can point to.
- A yes you can evidence on your insurance questionnaire
- Shared mailboxes and old accounts checked, not just staff logins
- Plain-English reports for partners and compliance
Three things that usually prompt the call.
An insurance questionnaire
The renewal asks whether you carry out regular vulnerability scanning. The honest answer is "our IT provider keeps an eye on things", which isn't a yes.
Shared mailboxes full of client ID
A shared inbox receives passports and bank statements every week, but was left out when multi-factor sign-in went on, because it "isn't a person".
A network or platform review
Your network, a platform or a larger client asks for evidence of your security controls, and you need something independent to put behind your answers.
What we look at in a firm like yours.
Checked against how an advice firm actually works: client documents arriving by email, and lots of systems holding the same personal data.
Accounts and sign-in
Multi-factor sign-in on every account, including shared mailboxes and old admin logins, and admin rights only where needed.
Email that can't be faked
SPF, DKIM and DMARC set up and enforced, so nobody can email your clients from your firm's address.
Where client documents land
Shared inboxes, portals and file stores that receive ID and statements, and who can get into them.
Laptops and patching
Every device on software that still gets security updates, including adviser laptops used away from the office.
What faces the internet
Old remote access and anything else reachable from outside, mapped, closed or locked down.
Backups that survive
A copy of client records that ransomware on your network couldn't also reach.
From first call to a closed report, with nothing technical asked of you.
Every stage is a fixed price, agreed before it starts. See what each stage costs.
Scoping call
Thirty minutes on your firm, your systems and what's driving the test. You get the fixed price for the test at the end of it.
Test, report, walkthrough
We run the assessment on agreed dates, then go through the ranked report with you: what's serious, what isn't, and what we'd fix first.
Fix, re-test, evidence
If you want the findings closed, we do the work with your IT provider, re-test every fix and hand over the evidence pack.
IFA firm, 25 staff, lender questionnaire outstanding
The external footprint was clean, but the internal network had two legacy servers still reachable. They were decommissioned, and the questionnaire went back with the report attached.
Illustrative engagement showing the shape of the work, not a named client.
What firms like yours usually ask first.
Does this replace what our network or compliance team asks for?
No. It gives you independent evidence to put behind your answers. Most questions about testing, patching, access and multi-factor sign-in can be answered from the report.
Our IT provider says we're fine. Why test?
They may well be right. An independent test is how you prove it to an insurer or a client, and it usually finds a few things nobody inside the firm could see.
Will advisers be interrupted?
No. Testing runs on agreed dates without disrupting staff, and anything that could affect a live system is agreed first and run out of hours.
Do you look at client data?
No. We look at configuration and exposure, not at client files. Access is through named accounts you control, and it's removed in writing when we finish.