Services: Free Assessment, Remediation and Monitoring

Before anything starts

Nothing happens without written authorization

Every engagement starts with a signed scope, including the free assessment. It spells out:

What’s covered: the specific networks, email domain, and accounts.
What isn’t: anything your business doesn’t own or control, like landlord or internet-provider equipment.
When: the dates and time windows for remote and on-site work.
Who approved it: an owner or manager with the authority to say yes.
How your data is handled, and what happens if something urgent turns up.

If you have an IT provider, they get the plan in writing first. You can pause or stop the work at any time.

Sample scope of work

Illustrative example. Every real scope is written for the specific client and signed before any work begins.

Parties: [Client business name] and EmberGuard Security
What’s covered: External exposure check; email spoofing protection check (SPF, DKIM, DMARC); internal network vulnerability scan; Microsoft 365 or Google account and settings review; breached-email check; backup check. All read-only. Nothing is changed.
Not covered: Fixes, active breach response, compliance sign-off, systems the client doesn’t own or control, and any attempt to break in or exploit systems
Client confirms: They own or control everything in scope, and that older or fragile equipment (legacy servers, old printers, phone systems, point-of-sale) has been listed for exclusion, understanding that scanning can affect older gear
Access: The owner logs in once to authorize. We create a limited temporary account, and it’s removed at the end with the client confirming. We never ask for or keep anyone’s personal password.
When: [Time windows], approved by [owner or manager]
IT provider: Notified in writing first
Data handling: Findings stored encrypted and securely deleted when the work ends
Stopping: Either side can stop at any time. If something urgent turns up, we stop and tell the client right away.

Client signature and date

EmberGuard Security signature and date

Step 1 · Free

Free security assessment

Cost: Free
On-site: When needed
Results: Within a week

A vulnerability assessment finds your weak spots and ranks them by how serious they are. Nothing on your systems is changed.

What we check

External exposure. What anyone on the internet can see and reach.
Email spoofing protection. Whether criminals can send email that looks like it came from your business address (SPF, DKIM, DMARC).
Your network. An internal scan of computers, servers, printers, and network equipment for known flaws or missing updates.
Accounts and settings. How your Microsoft 365 or Google accounts are set up, including two-step sign-in and admin access, compared against published security baselines.
Leaked passwords. Staff email addresses that show up in known data breaches.
Backups. Whether your email and files are actually backed up and could be restored.

What you get

A one-page scorecard with your five numbers
Your top three risks, ranked by severity
A walkthrough of the results, in person or by phone

The scorecard shows what’s wrong and how serious it is. Step-by-step fixes are part of remediation.

Scans use safe settings, fragile equipment can be left out, and heavier checks can run after hours.

Step 2

Remediation

Cost: Quoted per project
Pricing: Flat, not hourly
Based on: What was found

We fix what the assessment found, starting with the most serious risks.

After the assessment, you get a flat written quote per project, based on what was found and the size of your business. Fix only the critical issues or everything at once. Nothing starts until you approve it in writing.

Typical work

Close anything exposed to the internet that shouldn’t be, like open remote access
Turn on two-step sign-in for email and other key accounts
Stop others from sending email in your name
Block risky email forwarding rules
Install missing updates and plan replacements for computers past end of support
Tighten Microsoft 365 or Google Workspace settings
Reset exposed passwords and remove old or unused accounts
Set up backups for your email and files

Each fix is checked before the project closes, and you get a short record of what changed.

Working with your IT provider

We can work alongside them. We can hand over the findings, or handle the security work while they keep running your day-to-day IT.

Not included

Responding to an active breach, compliance sign-off, and work on systems your business doesn’t control. If you need one of those, we’ll tell you and help you find the right people.

Step 3 · Optional

Ongoing monitoring

Cost: Flat monthly fee
Based on: Business size
Report: Monthly, one page

Protections get turned off and new problems appear. Monitoring catches the ones that affect you before they become expensive.

What’s included

A monthly settings check to catch protections that get turned off
Breach alerts for staff email addresses
Quick fixes
A one-page monthly report: what’s new, what’s fixed, and what to do next
Direct answers when you have a security question

Monitoring means scheduled checks and alerts. It isn’t round-the-clock monitoring or emergency response.

FAQ

Common questions

Is the assessment really free?

Yes. The assessment is free and the scorecard is yours to keep, with no obligation. It lets you see our work before you decide whether to pay for anything.

Will it disrupt my office?

It’s designed not to. Scans use safe settings, fragile equipment can be left out, and heavier checks can run after hours.

What access do you need?

You log in once to authorize us. We then set up a limited, temporary account, do the work, and remove it when we’re done, with you confirming. We never ask for your personal password.

We already have an IT company. Do we need this?

An independent check is useful either way. We’re not there to replace them. They’re told before any work starts, and we can share findings with them.

What if you find something serious?

If there are signs someone is already in your systems, we stop and tell you right away. Breach response is separate work, and we’ll help you get the right people involved.

Is this a compliance audit?

No. It’s a security assessment, not a certification or legal review. The results can still support compliance work you’re doing.

Do you work outside Columbia?

We’re based in Columbia and work across the Midlands. If you’re farther out, ask.

One free assessment. Then only what you need.