Four to six weeks, start to finish. That covers the security workshop, the staff assessment, the productivity suite audit, and — if it's relevant to you — the app assessment. It's not a one-afternoon audit and it's not a six-month project either.

Fewer people than you'd think, but the right ones. You need a Cyber Security Champion — someone senior enough to coordinate and make calls, whether that's a CIO, CTO, or a director. You need leadership involved enough that whatever comes out of this actually connects to how the business runs. And you need input from the staff who touch the technology day to day, because they're the ones who'll tell you what the risk actually looks like in practice, not just on paper. If you work with vendors or outside partners who touch your systems, we bring them in too, through questionnaires and workshops.

We start the workshop stage against the NIST Cybersecurity Framework — that's the global standard, not something we invented. From there it gets tailored to your organization specifically. The framework tells us what to look for; the roadmap tells you what to actually do about it.

Three things. A clear, actionable roadmap you can hand to any vendor, not just us. A real picture of how ready your staff actually are to handle a threat. And specific recommendations for locking down whatever you're running your business on day to day — Google Workspace or Microsoft 365.

Both, and honestly the staff side is usually where the surprises are. We run phishing simulations, check whether any of your staff's email addresses or passwords are already circulating on the dark web, and test general cybersecurity knowledge. The goal isn't to catch anyone out — it's to find out where the real gaps are before someone else does.

It means checking whether your team's credentials — an email and password combination — have already shown up in a data breach that's now circulating among criminals. This happens more than people expect, and often through a service you don't even use, because someone reused a password. You'd rather find that out from us than find out from someone breaking in.

Most phishing training runs on its own, disconnected from anything else. Ours feeds directly into the roadmap — if certain people or departments come back as higher risk, that shapes what training path they get and what controls we prioritize around them. It's not a checkbox. It's an input.

We use best-in-class tooling in each category rather than tying you to one vendor's badge. RMM tooling gives us an accurate inventory of what's on your network, keeps patching on track, and produces vulnerability reporting. Password vaults minimize password reuse, enforce complexity requirements, and let staff share credentials securely instead of over email. Device management, identity and single sign-on, and endpoint threat detection each run on established platforms, with alerts centralized into one ticketing system so nothing sits unresolved in someone's inbox. Which specific products we use changes as the market changes — the categories and the standard don't.

Both, and they're different things on purpose. We run vulnerability assessments monthly across your endpoints, cloud apps, and critical systems — that's the routine check. Separately, we run a full penetration test annually, which is a real attempt to break in, so you find the gap before someone with worse intentions does.

Yes. The productivity suite audit covers Google Workspace and Microsoft 365 equally, and the data protection work covers cloud file storage on either side. We're not a Microsoft-only shop pretending otherwise.

Within limits, and it's worth being straight about where those limits are. We can review how your development process is set up — access controls, where code and credentials live, how changes reach production — and we'll flag obvious problems if we see them. What we don't do is application security testing or code review. That's a genuine specialty with its own tooling and expertise, and if the assessment suggests you need it, we'll tell you that and help you find someone who does it properly rather than pretending it's in scope.

No, and that's intentional. What you get at the end is a roadmap built to work with any vendor. We'd obviously like to be the ones who help you carry it out, but the document itself doesn't lock you into that.

Part of the roadmap work is building and testing an incident response plan before you need one — not just writing it down, but running it through tabletop exercises so the people involved have actually walked through what happens when the phone rings at the wrong time.

It's worth a conversation rather than an assumption either way. Risk doesn't scale down as neatly as budget does — a ten-person nonprofit holding donor and client data is still a real target, just a differently-resourced one. The workshop stage is where we figure out together how much of this you actually need right now versus what can wait.