Someone should be watching
your admin console. We are.

No — ever. You grant read-only monitoring access from your own admin console while we're on a call together, and you can revoke it in one click at any time. We show you exactly what was granted, in writing, on day one.

No. We are your security team, not your help desk — we don't do printers, password resets, or email migrations. That discipline is why the service stays sharp and affordable. We're happy to work alongside whoever handles your IT.

Our engine flags it, our Security Architect verifies it's real, and then — only then — you hear from us. Urgent issues (like a break-in in progress) get a phone call once we confirm them, during business hours — with the exact fix laid out step by step, walked through together with you or your IT. Routine findings arrive in your weekly digest with plain-English explanations.

Yes — it's one of the most valuable things we do. On Guardian Plus and above we sit down with the questionnaire, close the gaps it exposes, and hand you an evidence packet at renewal time; the one-time Cyber-Insurance Readiness Checkup does the same once, with a scorecard your broker can read. What that does: it strengthens the controls insurers commonly evaluate and puts the evidence in your hands before renewal — which may support improved insurability, coverage terms or pricing. What it cannot do: promise a premium. The insurer decides, and we will never tell you otherwise.

You revoke our access from your own console — it works instantly and doesn't need our permission. We hand you an export of your security records and confirm deletion of our copies in writing within 30 days. Your agreement states its term and notice period in writing before you sign.

Those are excellent enterprise email-security products — built, priced, and staffed for organizations with a security team to receive their output. If you have a SOC and one of those contracts, Org Guard fits beside it: we cover the layers they don't touch — your admin console, cloud configuration, attack surface, breach exposure, and insurance evidence. If you don't have a security team, comparing us to them misses the point: they hand verdicts to analysts you'd still need to hire. Org Guard is the analyst — a flat-price fractional security team with its limits published in writing, which none of them will show you before a demo.

Alongside them, and they usually like us. Your MSP keeps things running and typically watches devices — endpoint protection, patches, backups. We watch the layer where organizational fraud actually starts: the email itself, the admin console, forwarding rules, sign-ins, and the money-movement pretexts no endpoint agent can see, because a fraudulent wire request contains no malware and never executes anything on a computer. When we find something, your MSP gets a precise, evidence-backed fix list instead of a vague alarm — we make them look good.

They're genuinely good — at what they were built for: bulk junk, known-bad links, malware. Keep them; we sit behind them, read-only. What they miss is the message written once, for one person, from a clean account — the vendor "banking update," the payroll-change request, the pastor asking for gift cards — because there is nothing technically wrong with it. And neither of them watches your admin console, where takeover evidence quietly accumulates. That is the gap we cover: the message that passes every technical check, read by a person before it becomes a phone call.

No, and that is deliberate. Everything we check reads public records and the logs you have granted us read-only access to — we never send an attack at your systems, never test whether a weakness can actually be exploited, and never capture or reuse your staff's credentials. Tools that do those things need signed authorization, specialist insurance and an incident plan for when a test goes wrong; that is a different product sold to organizations with a security team to receive it. Where a finding is inferred rather than directly observed — for example reading a software version a server advertises publicly — we label it as inferred and tell you to confirm it against your real patch level. Exactly what we can and cannot touch →

Because we run the same check again and report the result with a date. Every finding is tracked from the day we first saw it, and it is only marked closed after a re-check actually ran and could not find it. If the check itself fails, the finding stays open and the report says the check could not run — we never let something drift into "fixed" simply because we stopped being able to see it. And if a fixed issue comes back, the report says it came back, and how many times.