RIGHT NOW,
SOMEONE IS
SCANNING YOU.
// The scan never stops. We map your exposure before they do.
AI changed who's at the door. We map your real exposure, fix the quick wins on the spot, and hand you a 90-day hardening playbook your team can execute.
> ft-sec scan --perimeter --depth=full [■■■■■■■■■■] public_surfaces.......47 found [■■■■■■■■■■] oauth_grants..........34 active [■■■■■■■■■■] dependencies..........847 scanned [■■■■■■■■■■] ai_workflows..........6 flagged ┌───────────────────────────────────────┐ │ EXPOSURE SURFACES 94 TOTAL │ ├───────────────────────────────────────┤ │ ◉ critical 03 fix within 24h │ │ ◉ high 07 fix within 1 week │ │ ◉ medium 23 quick-win queue │ │ ◉ low 61 90-day playbook │ └───────────────────────────────────────┘ ➜ attack surface map ready.
The threat model shifted.
We focus on the 20% of hardening that closes 80% of your real exposure — the fixes that actually move risk, not the ones that look good in a report.
- xVulnerability research was expensive, slow, and skill-gated
- xAttackers scanned narrowly — specific CVEs, named targets
- xPatch windows of weeks were tolerable
- xYou were too small to be worth targeting at scale
- x2FA + strong passwords was a meaningful perimeter
- ◉AI tooling has collapsed the cost and skill floor of discovery
- ◉Attackers scan broadly — every surface, continuously
- ◉Patch windows have compressed from weeks to days
- ◉You're in scope because the cost of attacking you approaches zero
- ◉Identity, integration, and supply chain are the new perimeter
The headlines are loud. Most of them won't change how you operate.
AI security news is breaking weekly. Fear follows the news cycle. Your posture shouldn't. Here's what's actually showing up in the wire — and what each one means for an operator, translated out of the jargon.
Fear doesn't make you safer. A map does.
Every headline above collapses into three questions about your stack. If you can answer them, the news cycle is noise. If you can't, it's your calendar for the next six months.
We built this review so operators without a CISO can answer all three — in three weeks, for what a week of Big 4 consulting costs.
- 01
Is this surface live on our stack?
- 02
Is it in our patch cadence?
- 03
Can we close it before they reach it?
Hire a security lead.
$400K+/yr loaded. 6+ months to operational. Right answer at 500+ headcount.
Engage a top-tier consultancy.
$100K+ engagements. Compliance-shaped output. Right answer if the deliverable is a SOC 2 report.
Run a 3-week posture review.
$12–18K. Fixes shipped in-engagement. Playbook your team owns. Right answer for everyone in between.
// Between “no security program” and “full CISO function” there was no good option. That's the gap this review was built for.
Who this is for.
Mid-market operators ($5M–$100M) running on SaaS, custom apps, and integrations — without a dedicated security team or CISO.
>= 4 / 5
- 01Run on Google Workspace or M365 plus a dozen or more SaaS tools
- 02Have custom apps, internal automations, or AI workflows touching customer or financial data
- 03Integrate with third parties via API keys, OAuth, or webhooks
- 04Haven’t had a security review in 18 months — or ever
- 05Know you have “some posture” but can’t describe your actual attack surface
- 01Already have a full security team and formal program (SOC 2 Type II, ISO 27001 maturity)
- 02Need compliance certification as the primary deliverable
- 03Want a pen test only — we’re strategic and advisory, not offensive security
- 04Operate under HIPAA with active PHI breach history, or PCI-DSS Level 1
21 DAYS.
Three focused weeks. Runs in parallel with Audit + Playbook when bundled. Integrated deliverables at handoff.
Attack Surface Mapping
- ›3–5 stakeholder interviews
- ›Read-only access to Workspace/M365, SaaS admin, code repos, cloud infra
- ›Automated scan: public assets, DNS, certificates
- ›Inventory: OAuth grants, API keys, service accounts, integrations
- ›Data flow mapping
Attack Surface Map
Assessment & Quick Wins
- ›Risk prioritization (likelihood × business impact)
- ›FIDO2 hardware key enrollment, up to 5 admin users
- ›OAuth audit + dormant API key cleanup
- ›Dependabot on up to 3 code repos
- ›AI-specific risk review: prompt injection, LLM data leakage
Quick Wins Report
Playbook & Training
- ›90-day hardening playbook, sequenced by impact
- ›Vendor recommendations (MDM, monitoring, specialist firms)
- ›Incident response starter plan
- ›60-minute leadership training session
- ›30 / 60-day check-ins (bundle only; +$2K standalone)
90-Day Playbook + Exec Summary
Three ways in.
Snapshot to pressure-test your exposure. Full review to harden your posture. Bundle with an Audit + Playbook for the best economics.
Security Snapshot
3–5 business days. Lightweight pressure-test of your external exposure. For operators who want a read on posture before committing to a full review.
- ›Automated scan of public-facing assets, DNS, certificates
- ›OAuth grant and API key inventory
- ›1-hour findings call with written summary
- ›Not included: remediation, 90-day playbook
Full Review — Bundled
33% off standalone — shared discovery, integrated playbook
3 weeks, runs in parallel with your Audit + Playbook. One discovery pass, one combined playbook covering operations and security.
- ›Attack Surface Map + Quick Wins Report
- ›90-Day Hardening Playbook, integrated with operations playbook
- ›60-minute leadership training + 2-page executive summary
- ›30- and 60-day check-ins included
Full Review — Standalone
The full review without a broader operations engagement. For operators who specifically want to address posture now.
- ›Attack Surface Map + Quick Wins Report
- ›90-Day Hardening Playbook
- ›60-minute leadership training + executive summary
- ›30/60-day check-ins optional (+$2K)
Pricing adjusts for scope: smaller environments may price at the floor, complex stacks (>20 SaaS, multiple custom apps) at the ceiling.
What this isn't.
Clarity here protects the engagement and sets expectations. If any of these are what you need, we'll say so upfront and point you to the right kind of firm.
Penetration testing
We identify surfaces and misconfigurations. We don’t actively exploit them. Refer to specialist shops.
Compliance certification
We align recommendations with SOC 2 / HIPAA / PCI where relevant. We don’t deliver the certification itself.
Ongoing monitoring / SOC services
We recommend, we don’t operate. We’ll name the vendors worth talking to.
Full remediation
Light remediation is included. Heavy remediation (custom code hardening, infrastructure re-architecture) is a separate Build engagement.
Legal or forensic investigation
If you’re actively breached, call an IR firm first, then us.
Questions worth asking.
Q_01How is this different from a penetration test?
How is this different from a penetration test?
A pen test actively exploits weaknesses to prove they exist. We map the exposed surface, prioritize by business impact, and fix the quick wins while we’re there. If you need active exploitation, we’ll refer you to a specialist shop — often as the next step after this review.
Q_02Do we need to be technical to work with you?
Do we need to be technical to work with you?
No. We interview the founder or operations lead. Where deeper technical access is needed, we work with your IT lead or MSP. Findings are written for operators, not security engineers.
Q_03What access will you need to our systems?
What access will you need to our systems?
Read-only where possible. Workspace/M365 admin, primary SaaS admin, code repos, cloud console. We scope access per system, document what we touch, and remove credentials at handoff.
Q_04What if you find something critical during discovery?
What if you find something critical during discovery?
We pause discovery, escalate to your leadership the same day, and either fix it in place (if in scope) or connect you with an incident response firm if it’s active. Criticals don’t wait for Week 3.
Q_05How do you handle our data and findings during the engagement?
How do you handle our data and findings during the engagement?
Findings live in an encrypted shared workspace scoped to you. Raw credentials and access tokens never leave your environment. At handoff, the working workspace is archived; you keep the deliverables.
Q_06Will this help us with SOC 2 or other compliance?
Will this help us with SOC 2 or other compliance?
Indirectly. We flag which findings map to common SOC 2 / HIPAA / PCI controls so your compliance partner has a head start. We don’t deliver certification.
Q_07What happens after the 90-day playbook?
What happens after the 90-day playbook?
You own the playbook — execute with your team, your MSP, or anyone you choose. Optional check-ins keep momentum. Deeper remediation rolls into a Build engagement if you want us to execute.
Q_08Can you work with our existing IT provider or MSP?
Can you work with our existing IT provider or MSP?
Yes. We coordinate with your MSP from Week 1. The playbook is written to be executable by a competent IT partner, not just by us.
MAP THE EXPOSURE.
30 minutes. We'll talk about your stack, where you think the gaps are, and which of the three engagements makes sense. No pitch. Just a conversation.