What we actually do, in plain words.
No jargon, no fear-mongering. Here is what working with us looks like — and what you get out of it.
Risk assessments & audits
Two sizes. The Baseline Security Review is the entry point: about two weeks — a staff survey, a few interviews, a look at your accounts and devices — ending in a short report with the fixes that matter most. The Risk Assessment & Roadmap goes deeper: four to five weeks, threat modeling, a scored matrix of your ten biggest risks, and a prioritized roadmap, presented to your management.
Start small if you like: Baseline clients get its price credited against the full assessment for 12 months.
Security policy development
Every newsroom and organization has habits; few have rules people actually follow. The Policy Starter Kit is one core digital security policy plus the two supporting documents you need most — think offboarding, devices, travel, communications — written in plain language, with the checklists that make them usable on deadline days. A built-in risk scan means we never write policy blind.
Policies people read. Yes, really.
Training & awareness
The Staff Training Day: a half or full day of hands-on sessions, tailored to your team with a short anonymous survey beforehand. Groups capped at 15, eight modules to pick from — passwords & 2FA, phishing, devices, secure messaging, self-doxxing, travel, incident basics. People leave with fixes already made on their own devices, and a one-page cheat sheet per module.
No lectures, no guilt — the kind of training people actually remember.
CISO as a service
Someone has to own security: make the calls, set the direction, pick up the phone when something feels wrong. We step in as your part-time security lead — someone who already knows your setup. Honest status: this only works if your security person actually knows you, which doesn't scale past a handful of organizations — so right now it runs as a waitlist.
Join the waitlist — five quick questions →
Device checks & spyware triage
When a phone or laptop feels off, we check it calmly and methodically: what happened, how bad it is, how to get back to work safely. When deeper analysis is warranted, we bring in specialist labs we trust. This one isn't a package — it's responsive work, scoped case by case.
Routine device checks are part of the Baseline Security Review. Discreet, structured, no drama.
External asset audit
Your website and email are the two things anyone can probe from the outside. We check them the way an attacker — and a spam filter — sees them: can your domain be spoofed, do your appeals and newsletters reach inboxes, what does your site leak. You get a plain-language scorecard, a prioritized fix list, and a 30-day re-test included — fixes you make show up green.
Fixed scope, clear deliverable — it fits neatly in a grant line.
Not sure which one you need? That's normal — most engagements start with a conversation.
Talk to us