Security Audit

The account nobody closed when somebody left is still an account. So is the shared password in a group chat, the router on its factory login, and the backup that has not run since March.

This is one fixed price for finding them and writing them down: each finding rated by severity, with what it would take to fix it. The report also lists what is already correct, because an audit that only lists faults is a sales document.

Rodrigo Landa, President of Metrolux Solutions Inc., leads every audit. When we audit a site we do not operate, the owner sees the findings first and has 30 days to fix them before anything is published; the disclosure policy covers the rest.

What it costs

$1,200 one time One fixed price for the audit and the written report. Fixing what it finds is quoted separately, and you are free to have somebody else do it.

How it works

1. We inventory the accessAccounts, devices, mailboxes, admin rights and anything still reachable from outside. Including the accounts nobody remembers creating.
2. We check the things that fail quietlyBackups that have not run, certificates about to expire, updates never applied, and mail authentication that lets anybody send as you.
3. We write it down with severitiesEach finding, how bad it is, what it would take to fix. Findings describe the weakness and the remedy, never a working exploit.

Who this is for

• A business that has had staff leave and cannot say for certain what those people can still open.
• A business asked by a client or an insurer to show that it has looked.
• A business that has just been through an incident and needs to know what else is open.

Who this is not for

You need a compliance certificate

This is not one and will not be accepted as one. If an auditor has to sign something for a framework, you need that auditor, and we will tell you so rather than take $1,200 for a document that does not satisfy them.

You only want the website checked

Then Website Quality Audit is $500 and covers the site specifically. This one looks at the business, and paying the difference for a narrower question is a waste.

Nobody will act on the findings

A written record of a problem nobody fixes is worse than no record, because it proves the problem was known. If there is no budget or intent to remediate, do not buy this yet.

Worth having alongside

• Network AssessmentAn audit asks who can reach what. An assessment asks whether the network carrying them actually works.›
• Web & Email HostingA large share of these findings are an expired certificate and mail anybody can forge. Managed hosting is where both stop happening.›
• Office IT MaintenanceMost findings are things that drifted because nobody was watching. This is somebody watching.›