Who we serve
Small businesses and the mid-market, reached through their MSP.
We use these terms the way the industry does. The definitions below are how we draw the lines.
Small business (SMB)
A company with fewer than about 100 employees and usually under $10M in annual revenue. Typically has no security staff and relies on an outside IT provider.
- Example
- A 40-person accounting firm or dental group
Mid-market
A company with roughly 100 to 1,000 employees, and revenue from about $10M up to $1B. Big enough to hold data worth stealing, often without a full security team.
- Example
- A 300-person regional manufacturer or healthcare network
MSP (managed service provider)
An IT company that runs a business's technology under a recurring contract: help desk, devices, Microsoft 365, backups and network. Clients often see it as "our IT department".
- Our focus
- US MSPs with about 10 to 25 staff, $2.5M to $6M revenue, 40 or more active clients, and no in-house security or compliance team
MSSP (managed security service provider)
A provider whose core business is security operations, such as 24/7 monitoring and incident response. We do not compete with MSSPs and we are not one.
- Not our focus now
- Mature MSSPs, enterprise MSPs, and MSPs with fewer than 20 clients
Our sweet spot is the client an MSP manages at roughly 20 to 250 seats, which spans the upper end of small business and the lower mid-market. About 4,000 US MSPs fit our focus (founder's estimate from US Census data, range 3,300 to 4,800).
A story
Dana, her 60 clients, and one renewal.
Dana runs a 15-person MSP with 60 clients. One of them, a 40-person accounting firm, forwards its cyber-insurance renewal on a Tuesday with a Friday deadline. The example is illustrative; the situation is one MSPs describe to us again and again.
Today
"Is MFA on everywhere?"
Dana's senior tech spends most of a day on the form, checking the tenant and guessing at the backup question. The answers live in an email thread. The gaps the form exposed, such as no managed detection, become a "we should look at that" with no price and no plan. Next month a different client sends a different form, and the work starts again.
With Value Aligners
"Here are your top three, and what each costs."
Dana runs one intake for the client, about 30 minutes, plus a read-only external scan with nothing installed. She gets the gaps mapped to the client's frameworks, in severity order, each labelled measured or self-reported, with a priced fix beside each one. She walks into the client meeting with a plan and a price. The fix is sold as her managed service, at her rate.
What is next: the record
Proof that someone checked each answer.
Insurers, customers and auditors increasingly ask how an answer was produced, not only what it says. Today every finding shows where it came from, and actions are written to an audit log. Next we are building the record: for each answer, the evidence, the AI model that drafted it, the named person who reviewed it, and what the client decided. It will be re-checked every quarter, so it is current at renewal time.
The record is kept by a party with no money in the outcome. That is the point of it. Record v1 is targeted for 4 December 2026 and not started yet. No insurer or broker has reviewed it so far.
Straight answers
Questions people ask first.
Who do you scan, and what do you touch?
The MSP's clients, with their consent, and businesses that come to us directly. The scan is read-only and external: web headers, TLS, email authentication and open ports. Nothing is installed and nothing runs inside the client's network.
Who owns the vendor license?
That follows each vendor's own licensing. Usually the MSP buys and manages it on the client's behalf. Where a vendor has no multi-tenant console, the MSP can administer a separate tenant per client. We work this out with each vendor at onboarding.
Do you go around the MSP to the client?
No. Managed clients are reached only through their MSP and see the plan under the MSP's name. Businesses with no MSP can use the free scan on their own.
Can a vendor pay for a better position?
No. Ranking is by fit to the finding. No vendor can buy placement, and listing is free.
Why both small business and mid-market?
Small businesses need the clearest first step. Mid-market companies are big enough to hold valuable data but often lack a full security team, and they face more insurance and customer scrutiny. Both are served by MSPs, and the same intake works for both.
Where is the data hosted?
On Microsoft Azure in the US West region, with secrets in Azure Key Vault and TLS in transit. AI drafting runs on Google Vertex AI and Anthropic. SOC 2 is a target we have not started.