HOW IT WORKS
How Cyber Defensibility Works
We handle the ongoing cybersecurity work. You see what is protected, what was corrected, and what needs your decision.
We bring agreed protections under management, validate coverage as your firm changes, correct routine gaps, and report the results.
1 · ASSESS
Start with your situation.
Agree what needs a closer look.
The approximately 30-minute Cybersecurity Review is a conversation about current protections, who handles cybersecurity, and what concerns you. No technical preparation is required.
If uncertainty warrants investigation, we may recommend a separate, limited Security Control Validation of selected protections. Its scope depends on what needs clarification.
If your current team already manages the required cybersecurity work effectively, an additional service may not be necessary.
THE STARTING CONVERSATION
People & responsibilities
Devices & systems
Accounts & access
Current protectionsDiscuss what exists today and the work you need handled. Technical validation, if appropriate, is a separate step.
2 · PROTECT
Put the agreed protections under management.
Onboarding usually completes within 30 days of starting. We work with your designated contact and existing IT resources to establish a clear starting point.
Confirm the covered environment
Users, devices, systems, and the required access.
Agree the protections
Controls, provider coordination, and any tool changes.
Bring controls under management
Configure agreed protections and address initial gaps.
Verify the starting coverage
Establish monitoring and document remaining actions.
Timing depends on your environment, access, provider coordination, and additional remediation. Onboarding starts the service; monitoring, validation, and correction continue.
3 · VALIDATE
Check what should be protected—
and what actually is.
A security dashboard can show healthy installed agents while omitting a new computer that has no agent at all. We compare the intended environment with actual protection to find missing coverage.
Expected protection
The covered device roster
Actual protection
What the coverage check finds
Illustrative example: a replacement computer is on the covered roster but is missing its endpoint security agent. This diagram is not a customer result. The same coverage principle applies across agreed controls.
4 · CORRECT
Follow routine gaps through to a verified correction.
Finding the problem is only part of the work. For routine gaps covered by your service, we investigate, make the correction, and check that the required protection is restored.
Routine covered issue
Investigate → Correct → Recheck
Restore the required protection and record the result within the access and authority agreed for the service.
Needs a decision or extra work
Explain → Recommend → Get approval
Involve your firm or another provider when authorization, coordination, or separately scoped work is required.
Major projects and specialist work are scoped separately unless expressly included in your agreement.
5 · REPORT
See the work.
Know what needs attention.
Your monthly report shows what is protected, what we found, what was corrected, and what remains open or needs your decision.
You receive a management summary without having to interpret security logs or manage the tools. Scheduled reviews cover changes, priorities, and unresolved issues.
Urgent matters are raised when they need attention, rather than waiting for the next monthly report.
Illustrative entries show how findings, work, and next actions can be made understandable. They are not actual results or a promise of a specific report format.
YOUR TEAM’S PARTICIPATION
Clear roles. Manageable participation.
We handle technical work within the agreed service. Your team provides the access, information, cooperation, and decisions needed to carry it out.
IT Assure handles
Agreed protections and coverage checks
Routine covered corrections and rechecking
Reporting and recommended next actions
Your firm provides
Accurate staff and device updates
Necessary access and staff cooperation
Business decisions and required approvals
Scheduled reviews are quarterly or twice yearly, as agreed. These are planning estimates, not maximum commitments. Incidents, projects, employee security activities, and significant changes may require more involvement.
Existing IT resources can continue supporting general IT and business applications. See how co-managed cybersecurity works →
CHOOSE YOUR STARTING POINT
Take the next step that fits your firm.
Have a concern to discuss?
Book an approximately 30-minute Cybersecurity Review to discuss your situation, service fit, and whether selected controls warrant a closer look.
No technical preparation required. No obligation to engage. Technical validation is a separate step.
Still exploring?
The optional Quick Self-Check helps you consider whether protections are being checked and routine gaps corrected.
Its results reflect your answers; it is not a technical inspection. You can book a Review directly without completing it.
Know what you are agreeing to. Your proposal and agreement define covered protections, responsibilities, fees, cancellation terms, and any separately approved commitments. Cyber Defensibility does not include unlimited IT support, every project, compliance certification, penetration testing, or advanced forensic and incident-response work unless expressly included. Cybersecurity reduces risk but cannot eliminate breaches. Cyber insurance is separate; IT Assure does not determine coverage or claim payment. Review service details → · See plans and pricing →