Skip to main content
The right place to start

Security Reality Check

Know what attackers see, what to fix first, and whether you are ready for a real pen test - without a 400-page scanner dump.

Book a 20-Min Fit Call See Deliverables

Why start here

  • Best first engagement - sets up a meaningful pen test later
  • Operator-validated findings - no false-positive noise
  • Executive summary plus IT-actionable remediation roadmap
  • Written authorization only · MSP-friendly · CEO-led

Best fit: SMB and mid-market teams needing a first external security baseline. Typical range: $2,500–$10,000 · Timeline: 2–3 weeks.

What You Get

Concrete deliverables - not just a verbal debrief.

Executive Summary

Board-ready overview: risk posture, top exposures, business impact, and recommended next steps.

Prioritized Remediation Roadmap

Findings ranked by exploitability + business risk, each paired with explicit fix-it guidance for IT or your MSP.

Operator-Validated Findings

Every finding hand-reviewed. We strip false positives and add real-world context - no scanner dumps.

30-Day Retest Window

After remediation, we re-validate Critical/High findings so you can prove the fixes hold.

Live Debrief with the CEO

A working session, not a slide deck - Q&A with the operator who actually ran the assessment.

Pen-Test Readiness Score

Honest read on whether you're ready for a meaningful pen test, or should remediate first.

Timeline

Roughly two weeks end-to-end. We won't drag it out.

Day 0–1

Scoping & Authorization

Define scope, sign written authorization, exchange contacts.

Day 2–10

Active Assessment

External attack surface, identity layer, internal high-value systems. Operator validation.

Day 11–14

Reporting & Debrief

Executive summary, IT roadmap, live debrief with the CEO.

Day 15–45

Remediation Window

You execute. We're available for questions during the 30-day retest window.

Common Scopes

Examples of what a Reality Check typically covers. We tailor to your environment.

External Attack Surface

  • Public IP & domain enumeration
  • Exposed services, ports, RDP/VPN/SMB
  • Cert hygiene, web app surface
  • Credential leak checks (deep + dark web)

Identity & M365 / Entra

  • MFA coverage gaps, legacy auth
  • Conditional access misconfigurations
  • Stale or over-privileged accounts
  • OAuth app sprawl & consent risk

Internal Network & AD

  • AD hygiene, Kerberoasting, ASREP-roasting
  • SMB/share misconfigurations
  • Patch posture on critical systems
  • Endpoint protection & logging coverage

Reality Check vs. Pen Test - Which Do You Need?

Both are standalone offerings. Here's how to choose.

Start here: Security Reality Check

  • You haven't had a structured assessment in 12+ months
  • Compliance/insurance asks for evidence of a current assessment
  • You suspect there are basics to fix before a pen test would teach you something new
  • You want a prioritized list, not raw scanner output

Choose Pen Test if

  • You've already remediated known basics
  • Compliance specifically requires a penetration test
  • You need to prove (or disprove) a specific attack path
  • You want adversarial validation, not coverage analysis
See Penetration Testing →

Honest Pricing Ranges

No "contact us for pricing" theater. Here are the bands we typically scope into.

External Reality Check

$1,500 – $2,500

Public attack-surface review. Best for orgs with mostly cloud/SaaS exposure or as a pre-renewal sanity check.

Most Common

Standard Reality Check

$3,500 – $6,500

External + internal/identity layer + M365 review. The default scope for most SMB engagements.

Compliance / Insurance

$5,000 – $9,500

Adds a remediation map keyed to your insurer's questionnaire, HIPAA, or SP 800-171 - assessor-ready.

Final scope confirmed on the fit call. Most engagements include an optional retest within 30 days.

Know Where You Stand

Get the prioritized remediation list. Or if you already know your basics are solid - jump straight to a pen test.

Book a 20-Min Security Fit Call Need adversarial proof? See Pen Testing