Stop failing the security questions your clients, assessor and insurer ask.
Vulnerability testing and fixes for accounting, legal and financial advisory firms with 20 to 150 staff. Gaps found, fixed and re-tested. Evidence you can hand over. Your IT provider stays. Fixed-price testing from $1,350.
A test report comes back
Three reasons firms call us, usually the week before a deadline.
Accountants, attorneys and advisors rarely go looking for a security test. Someone asks for one.
A compliance review is due
An FTC Safeguards Rule review, a SOC 2 request or a state regulator's requirement is coming up and you want the gaps found and closed before the assessment, not flagged during it.
Your cyber insurance is renewing
The renewal questionnaire asks about vulnerability scanning, patching and monitoring, and answering "no" is starting to affect the premium or the cover.
A client wants evidence
A larger client, lender or partner has sent a supplier security questionnaire and you need an independent test report to sit behind your answers.
Four things you have at the end that you don't have today.
Not a 90-page scanner export. The things a managing partner can act on and an insurer will accept.
Findings ranked by real risk
External footprint, internal network, cloud accounts and email checked, then ranked by how likely each gap is to be used against you.
Gaps fixed, not just listed
The people who tested your systems patch, harden and reconfigure them, coordinated with your IT provider and re-tested before closure.
Evidence you can hand over
A plain-English summary for partners, a technical appendix for IT, and a closure report shaped for assessors, insurers and client questionnaires.
A position that holds
Optional month-to-month monitoring so the firm stays at the standard the test brought it to, and the next renewal is a formality.
Not sure what's exposed right now? Request the test
What an engagement looks like in practice.
Three illustrative engagements, written to show the shape of the work rather than name a client. They are examples of the work, not named clients.
Regional firm, 40 staff, review in three weeks
The test found an unpatched remote-access gateway and shared admin accounts on the firm's server.
Two-office law firm, 65 staff, insurer asking for evidence
Testing showed multi-factor sign-in missing on a third of accounts and no email authentication in place.
RIA firm, 25 staff, lender questionnaire outstanding
External footprint was clean; the internal network had two legacy servers still reachable.
Three fixed-price stages. Take one, two or all three.
Each stage is scoped and quoted on its own. Many firms start with the test to answer a specific question from an assessor, insurer or client, and decide about the rest once they've seen the report.
Vulnerability testing
A structured test of your external footprint, internal network and the systems your staff use every day, to find the weaknesses an attacker would find first.
DetailsRemediation
We fix what the test found rather than handing you a to-do list. Every fix is re-tested before we call it closed, and you get the evidence pack.
DetailsOngoing monitoring
Vulnerabilities reappear as software changes and staff join and leave. Monitoring keeps the firm at the standard the test brought it to.
DetailsFrom first call to a closed report, with nothing technical asked of you.
You don't need an in-house IT team. Point us at whoever looks after your systems, tell us what prompted the call, and we take it from there.
Scoping call
Thirty minutes on your firm, your systems and what's driving the test. You get the fixed price for stage one at the end of it, and no obligation to go further.
Test, report, walkthrough
We run the assessment on agreed dates, then go through the ranked report with you: what's serious, what isn't, and what we'd fix first.
Fix, re-test, evidence
If you want the findings closed, we do the work with your IT provider, re-test every fix and hand over the evidence pack. Monitoring is optional afterwards.
Which security questions would your firm fail today?
Ten yes-or-no questions based on what security assessors and cyber insurers actually ask. No email address needed: the result shows on the page.
The things partners usually ask first.
Will testing disrupt our systems or our staff?
No. The assessment is scheduled with you and run in a way designed not to interrupt normal work. If any check carries a risk of disruption we'll tell you and agree a time, usually out of hours.
Do we need our own IT team?
No. Most firms this size use an outsourced IT provider. We'll work with them directly on anything technical and keep you in the loop in plain English.
Do we have to buy all three stages?
No. Each stage is quoted and agreed separately. Many firms start with the test to answer a specific question and decide about remediation once they've seen the report.
Is this the same as a SOC 2 audit or a compliance review?
No. An audit checks your controls against a framework. Our testing finds and fixes the weaknesses that would cause you to fail one, or that an audit doesn't cover, so you go into any review or insurance renewal ready.
How we handle access while we work.
Only the access the test needs
We ask for the minimum: read-only wherever it's enough, scoped to the systems in the agreed test plan, never blanket admin rights.
Named, revocable credentials
We work from accounts created for us, not shared passwords, so you can see what we did and switch our access off the moment we're done.
Findings stay between us
Reports are encrypted in transit and at rest, shared only with the people you name, and never used as case studies without written permission.
Access removed at closure
When the engagement ends, our accounts are disabled, test data is deleted, and you get written confirmation of both.
No disruption by default
Checks that could affect a live system are agreed with you first and run out of hours. Nothing destructive, ever.
Your IT provider is included
Whoever runs your systems day to day sees the plan before we start and the findings when we finish. We work with them, not around them.