{"title":"Quarterly Checkups","description":"\u003cp\u003eThe same scans, run again every 90 days, with a new report each time. Includes the quarterly versions of the Industries bundles.\u003c\/p\u003e","products":[{"product_id":"quickscan-quarterly-home-checkup","title":"Quarterly Home Checkup – 6 Scans, Every 90 Days, With Trend Reporting","description":"\u003cp\u003e\u003cstrong\u003eSecurity is not a thing you check once. It is a thing that drifts.\u003c\/strong\u003e\u003c\/p\u003e\u003cp\u003eThe Quarterly Home Checkup runs six scans across your computer and your home network, then does it again every 90 days — and every report after the first shows you what changed: what you fixed, what came back, and what appeared while you were not looking.\u003c\/p\u003e\u003ch3\u003eWhat's included\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eWindows Security Health Check\u003c\/strong\u003e ($29)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRansomware Readiness Check\u003c\/strong\u003e ($39)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eOut-of-Date Software Scan\u003c\/strong\u003e ($19)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eWi-Fi \u0026amp; Home Network Check\u003c\/strong\u003e ($29)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eSmart Device Exposure Scan\u003c\/strong\u003e ($39)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eBreach \u0026amp; Identity Exposure Check\u003c\/strong\u003e ($39)\u003c\/li\u003e\n\u003c\/ul\u003e\u003cp\u003e\u003cstrong\u003e$194 of scans per run. Annual plan: $149 for four runs — under $37 a quarter.\u003c\/strong\u003e\u003c\/p\u003e\u003ch3\u003eHow the annual plan works\u003c\/h3\u003e\u003cp\u003eThe first run happens the moment you are ready. The launcher then schedules itself to run again every 90 days on your own machine, using the answers you already gave, so you do not have to remember. Four reports over twelve months, each one a comparison against the last.\u003c\/p\u003e\u003ch3\u003eWhy the second report is worth more than the first\u003c\/h3\u003e\u003cp\u003eThe first report tells you where you stand. Every report after it tells you whether you are getting better — which findings you resolved, which have reappeared, which new devices joined your network, and which new breaches now include your email. That trend line is the entire point of a recurring checkup, and it is what a one-off scan can never give you.\u003c\/p\u003e\u003ch3\u003eWhat you get, every quarter\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003eOne written PDF report emailed back to you, typically within one business day of each run.\u003c\/li\u003e\n\u003cli\u003eA per-surface score plus your combined household picture.\u003c\/li\u003e\n\u003cli\u003eA resolved \/ still open \/ newly found comparison against your previous run.\u003c\/li\u003e\n\u003cli\u003eAttack-chain analysis across all six scans.\u003c\/li\u003e\n\u003cli\u003eA 90-day action plan sized to what you can realistically do before the next run.\u003c\/li\u003e\n\u003cli\u003eReporting built to CompTIA Security+ and PenTest+ practice standards.\u003c\/li\u003e\n\u003c\/ul\u003e\u003ch3\u003eChoosing your option\u003c\/h3\u003e\u003cp\u003e\u003cstrong\u003eAnnual Plan\u003c\/strong\u003e — four scheduled runs over twelve months with trend reporting. \u003cstrong\u003eSingle Run\u003c\/strong\u003e — one run, one report, no scheduling, if you want to try it first.\u003c\/p\u003e\u003ch3\u003eRequirements\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003eWindows 10 or Windows 11, on the machine and network you want checked\u003c\/li\u003e\n\u003cli\u003eRun as administrator\u003c\/li\u003e\n\u003cli\u003eAn internet connection\u003c\/li\u003e\n\u003cli\u003eAbout 25 minutes for the first run; later runs are unattended\u003c\/li\u003e\n\u003c\/ul\u003e\u003ch3\u003eWhat this is not\u003c\/h3\u003e\u003cp\u003eQuickScan is detection and advisory only. Nothing here exploits a weakness or changes a setting on your machine. The only thing it leaves behind is the scheduled task that runs the next checkup, and you can remove it at any time from the launcher. It is not a certification, an audit or an attestation.\u003c\/p\u003e\u003cp\u003e\u003csmall\u003eYour report is prepared with AI-assisted analysis under ThreatVector's security review protocols and checked against our false-positive triage rules before it is sent. Reports are produced by ThreatVector LLC. ThreatVector and its scan library are developed, sold and distributed by ThreatVector LLC.\u003c\/small\u003e\u003c\/p\u003e","brand":"ThreatVector","offers":[{"title":"Annual Plan – 4 quarterly runs","offer_id":52913670684984,"sku":"QTR-HOME-30","price":149.0,"currency_code":"USD","in_stock":true},{"title":"Single Run","offer_id":52913670717752,"sku":"QTR-HOME-30-1RUN","price":49.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1011\/7123\/3080\/files\/card-QTR-HOME-30_0c317b64-cf2b-432b-855c-6113420b3756.png?v=1788709361"},{"product_id":"quickscan-quarterly-remote-worker-checkup","title":"Quarterly Remote Worker Checkup – 6 Scans for a Laptop That Travels","description":"\u003cp\u003e\u003cstrong\u003eA laptop that works from cafes, hotels and client sites collects risk the way it collects Wi-Fi networks.\u003c\/strong\u003e\u003c\/p\u003e\u003cp\u003eThe Quarterly Remote Worker Checkup is six scans chosen specifically for a machine that leaves the building, repeated every 90 days so the drift gets caught before it matters.\u003c\/p\u003e\u003ch3\u003eWhat's included\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eWindows Security Health Check\u003c\/strong\u003e ($29)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eTravel \u0026amp; Public Wi-Fi Check\u003c\/strong\u003e ($19)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eCredential Hygiene Check\u003c\/strong\u003e ($29)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eOut-of-Date Software Scan\u003c\/strong\u003e ($19)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eStartup \u0026amp; Persistence Check\u003c\/strong\u003e ($39)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eBreach \u0026amp; Identity Exposure Check\u003c\/strong\u003e ($39)\u003c\/li\u003e\n\u003c\/ul\u003e\u003cp\u003e\u003cstrong\u003e$174 of scans per run. Annual plan: $129 for four runs — about $32 a quarter.\u003c\/strong\u003e\u003c\/p\u003e\u003ch3\u003eHow the annual plan works\u003c\/h3\u003e\u003cp\u003eThe first run happens when you are ready. The launcher then schedules itself every 90 days on your machine using the answers you already gave. Four reports over twelve months, each compared against the last.\u003c\/p\u003e\u003ch3\u003eWhy quarterly matters for a travelling laptop\u003c\/h3\u003e\u003cp\u003eThis is the machine most likely to accumulate remembered open networks, stale saved credentials to other systems, and software that quietly fell out of support between trips. A single scan tells you the state today; four tell you whether your habits are holding.\u003c\/p\u003e\u003ch3\u003eWhat you get, every quarter\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003eOne written PDF report emailed back to you, typically within one business day of each run.\u003c\/li\u003e\n\u003cli\u003eA per-surface score and a combined picture of the device.\u003c\/li\u003e\n\u003cli\u003eA resolved \/ still open \/ newly found comparison against your previous run.\u003c\/li\u003e\n\u003cli\u003eAttack-chain analysis across all six scans — particularly saved credentials plus persistence plus breach exposure.\u003c\/li\u003e\n\u003cli\u003eA 90-day action plan sized to what you can actually finish.\u003c\/li\u003e\n\u003cli\u003eReporting built to CompTIA Security+ and PenTest+ practice standards.\u003c\/li\u003e\n\u003c\/ul\u003e\u003ch3\u003eChoosing your option\u003c\/h3\u003e\u003cp\u003e\u003cstrong\u003eAnnual Plan\u003c\/strong\u003e — four scheduled runs over twelve months with trend reporting. \u003cstrong\u003eSingle Run\u003c\/strong\u003e — one run, one report, no scheduling.\u003c\/p\u003e\u003ch3\u003eRequirements\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003eWindows 10 or Windows 11 laptop\u003c\/li\u003e\n\u003cli\u003eRun as administrator\u003c\/li\u003e\n\u003cli\u003eAn internet connection\u003c\/li\u003e\n\u003cli\u003eAbout 25 minutes for the first run; later runs are unattended\u003c\/li\u003e\n\u003c\/ul\u003e\u003ch3\u003eWhat this is not\u003c\/h3\u003e\u003cp\u003eQuickScan is detection and advisory only. Nothing here exploits a weakness or changes a setting on your machine. It never reads, decrypts or transmits a stored password. It is not a VPN, and it is not a certification, an audit or an attestation.\u003c\/p\u003e\u003cp\u003e\u003csmall\u003eYour report is prepared with AI-assisted analysis under ThreatVector's security review protocols and checked against our false-positive triage rules before it is sent. Reports are produced by ThreatVector LLC. ThreatVector and its scan library are developed, sold and distributed by ThreatVector LLC.\u003c\/small\u003e\u003c\/p\u003e","brand":"ThreatVector","offers":[{"title":"Annual Plan – 4 quarterly runs","offer_id":52913670750520,"sku":"QTR-LAPTOP-31","price":129.0,"currency_code":"USD","in_stock":true},{"title":"Single Run","offer_id":52913670783288,"sku":"QTR-LAPTOP-31-1RUN","price":45.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1011\/7123\/3080\/files\/card-QTR-LAPTOP-31_e744d5c2-84be-4002-af0f-9cb05f4b964d.png?v=1788709361"},{"product_id":"quickscan-quarterly-small-office-checkup","title":"Quarterly Small Office Checkup – 8 Scans, Every 90 Days","description":"\u003cp\u003e\u003cstrong\u003eThe recurring security review a small office needs, without the monthly platform fee or the consultant.\u003c\/strong\u003e\u003c\/p\u003e\u003cp\u003eThe Quarterly Small Office Checkup runs eight scans across your office computers, your network and the process controls insurers ask about — then repeats every 90 days with a report that shows exactly what moved.\u003c\/p\u003e\u003ch3\u003eWhat's included\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eWindows Security Health Check\u003c\/strong\u003e ($29)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRansomware Readiness Check\u003c\/strong\u003e ($39)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAccount \u0026amp; Access Review\u003c\/strong\u003e ($39)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eOut-of-Date Software Scan\u003c\/strong\u003e ($19)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eStartup \u0026amp; Persistence Check\u003c\/strong\u003e ($39)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eWi-Fi \u0026amp; Home Network Check\u003c\/strong\u003e ($29)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRouter \u0026amp; Wi-Fi Settings Checklist\u003c\/strong\u003e ($29)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eInsider Risk Self-Assessment\u003c\/strong\u003e ($39)\u003c\/li\u003e\n\u003c\/ul\u003e\u003cp\u003e\u003cstrong\u003e$262 of scans per run. Annual plan: $299 for four runs — $75 a quarter.\u003c\/strong\u003e\u003c\/p\u003e\u003ch3\u003eHow the annual plan works\u003c\/h3\u003e\u003cp\u003eThe first run happens when you are ready. The launcher schedules itself every 90 days using the answers you already gave. Four reports over twelve months, each one a comparison against the last.\u003c\/p\u003e\u003ch3\u003eWhy an office needs the recurring version\u003c\/h3\u003e\u003cp\u003eOffices change: staff join and leave, devices get added, someone plugs in a printer, a laptop falls behind on patches. The quarterly comparison is what turns a scan into evidence — a documented record that you check, and that findings get closed. That record is what an insurer or a larger client is actually asking for. The cheapest hosted vulnerability scanner runs $468 a year and does not produce a written analysis.\u003c\/p\u003e\u003ch3\u003eWhat you get, every quarter\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003eOne written PDF report emailed back to you, typically within one business day of each run.\u003c\/li\u003e\n\u003cli\u003eA per-surface score and a combined office risk picture.\u003c\/li\u003e\n\u003cli\u003eA resolved \/ still open \/ newly found comparison against your previous run.\u003c\/li\u003e\n\u003cli\u003eAttack-chain analysis across all eight scans.\u003c\/li\u003e\n\u003cli\u003eAnswers phrased for a cyber-insurance application.\u003c\/li\u003e\n\u003cli\u003eA 90-day action plan ordered by impact.\u003c\/li\u003e\n\u003cli\u003eReporting built to CompTIA Security+ and PenTest+ practice standards.\u003c\/li\u003e\n\u003c\/ul\u003e\u003ch3\u003eChoosing your option\u003c\/h3\u003e\u003cp\u003e\u003cstrong\u003eAnnual Plan\u003c\/strong\u003e — four scheduled runs over twelve months with trend reporting. \u003cstrong\u003eSingle Run\u003c\/strong\u003e — one run, one report, no scheduling.\u003c\/p\u003e\u003ch3\u003eRequirements\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003eWindows 10 or Windows 11, on the office machine and network you want checked\u003c\/li\u003e\n\u003cli\u003eRun as administrator\u003c\/li\u003e\n\u003cli\u003eAn internet connection\u003c\/li\u003e\n\u003cli\u003eAbout 40 minutes for the first run; later runs are unattended\u003c\/li\u003e\n\u003c\/ul\u003e\u003ch3\u003eWhat this is not\u003c\/h3\u003e\u003cp\u003eQuickScan is detection and advisory only. Nothing here exploits a weakness or changes a setting. Part of the Insider Risk assessment is based on your own answers, and the report states which findings came from you rather than from observation. It is not a certification, an audit or an attestation, and it is not insurance advice.\u003c\/p\u003e\u003cp\u003e\u003csmall\u003eYour report is prepared with AI-assisted analysis under ThreatVector's security review protocols and checked against our false-positive triage rules before it is sent. Reports are produced by ThreatVector LLC. ThreatVector and its scan library are developed, sold and distributed by ThreatVector LLC.\u003c\/small\u003e\u003c\/p\u003e","brand":"ThreatVector","offers":[{"title":"Annual Plan – 4 quarterly runs","offer_id":52913670816056,"sku":"QTR-OFFICE-32","price":299.0,"currency_code":"USD","in_stock":true},{"title":"Single Run","offer_id":52913670848824,"sku":"QTR-OFFICE-32-1RUN","price":119.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1011\/7123\/3080\/files\/card-QTR-OFFICE-32_65322e8e-dd89-484c-9a67-9e8787bde170.png?v=1788709361"},{"product_id":"quickscan-quarterly-web-presence-checkup","title":"Quarterly Web Presence Checkup – 6 Internet-Facing Scans, Every 90 Days","description":"\u003cp\u003e\u003cstrong\u003eYour external footprint changes every time someone adds a subdomain, renews a certificate, or spins up a bucket for one job.\u003c\/strong\u003e\u003c\/p\u003e\u003cp\u003eThe Quarterly Web Presence Checkup covers everything your business exposes to the internet and rechecks it every 90 days, so drift is caught in weeks rather than after an incident.\u003c\/p\u003e\u003ch3\u003eWhat's included\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eInternet Exposure Scan\u003c\/strong\u003e ($69)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eWebsite \u0026amp; Storefront Checkup\u003c\/strong\u003e ($69)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eCertificate \u0026amp; Encryption Check\u003c\/strong\u003e ($19)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eEmail Spoofing \u0026amp; BEC Check\u003c\/strong\u003e ($39)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eCloud Storage Exposure Check\u003c\/strong\u003e ($49)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eDigital Footprint Report\u003c\/strong\u003e ($49)\u003c\/li\u003e\n\u003c\/ul\u003e\u003cp\u003e\u003cstrong\u003e$294 of scans per run. Annual plan: $349 for four runs — $87 a quarter.\u003c\/strong\u003e\u003c\/p\u003e\u003ch3\u003eHow the annual plan works\u003c\/h3\u003e\u003cp\u003eThe first run happens when you are ready. The launcher schedules itself every 90 days using the answers you already gave. Four reports over twelve months, each compared against the last.\u003c\/p\u003e\u003ch3\u003eWhy quarterly matters for a web presence\u003c\/h3\u003e\u003cp\u003eCertificates expire on a schedule. New subdomains appear in public certificate logs the moment they are issued. Storage gets opened for one file and never closed. A quarterly rhythm catches all three while they are still cheap to fix — and gives you a documented history that a client's security questionnaire will ask for. A hosted scanner covering less than this starts at $468 a year, and a DMARC platform is another $432 on top.\u003c\/p\u003e\u003ch3\u003eWhat you get, every quarter\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003eOne written PDF report emailed back to you, typically within one business day of each run.\u003c\/li\u003e\n\u003cli\u003eA per-surface score and a combined external risk picture.\u003c\/li\u003e\n\u003cli\u003eA resolved \/ still open \/ newly found comparison against your previous run.\u003c\/li\u003e\n\u003cli\u003eAttack-chain analysis across all six scans — exposed service plus weak certificate plus forgeable domain is one story, not six findings.\u003c\/li\u003e\n\u003cli\u003eA 90-day remediation plan ordered by what an attacker reaches for first.\u003c\/li\u003e\n\u003cli\u003eReporting built to CompTIA Security+ and PenTest+ practice standards.\u003c\/li\u003e\n\u003c\/ul\u003e\u003ch3\u003eChoosing your option\u003c\/h3\u003e\u003cp\u003e\u003cstrong\u003eAnnual Plan\u003c\/strong\u003e — four scheduled runs over twelve months with trend reporting. \u003cstrong\u003eSingle Run\u003c\/strong\u003e — one run, one report, no scheduling.\u003c\/p\u003e\u003ch3\u003eRequirements\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003eWindows 10 or Windows 11\u003c\/li\u003e\n\u003cli\u003eRun as administrator\u003c\/li\u003e\n\u003cli\u003eAn internet connection\u003c\/li\u003e\n\u003cli\u003eYour domain, public address and storage names — you must own them or be authorised to test them\u003c\/li\u003e\n\u003cli\u003eAbout 40 minutes for the first run; later runs are unattended\u003c\/li\u003e\n\u003c\/ul\u003e\u003ch3\u003eWhat this is not\u003c\/h3\u003e\u003cp\u003eQuickScan is detection and advisory only. Nothing here logs in, submits an attack payload, exploits a weakness or changes anything on your systems. It is not a penetration test, a certification, an audit or an attestation.\u003c\/p\u003e\u003cp\u003e\u003csmall\u003eYour report is prepared with AI-assisted analysis under ThreatVector's security review protocols and checked against our false-positive triage rules before it is sent. Reports are produced by ThreatVector LLC. ThreatVector and its scan library are developed, sold and distributed by ThreatVector LLC.\u003c\/small\u003e\u003c\/p\u003e","brand":"ThreatVector","offers":[{"title":"Annual Plan – 4 quarterly runs","offer_id":52913671143736,"sku":"QTR-WEB-33","price":349.0,"currency_code":"USD","in_stock":true},{"title":"Single Run","offer_id":52913671176504,"sku":"QTR-WEB-33-1RUN","price":109.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1011\/7123\/3080\/files\/card-QTR-WEB-33_7bfc44a6-42ae-4182-906a-c3912b440322.png?v=1788709377"},{"product_id":"quickscan-quarterly-identity-checkup","title":"Quarterly Identity Checkup – Breach Monitoring With a Written Report","description":"\u003cp\u003e\u003cstrong\u003eNew breaches surface every week. A scan you ran in January says nothing about what leaked in March.\u003c\/strong\u003e\u003c\/p\u003e\u003cp\u003eThe Quarterly Identity Checkup runs the same three exposure scans four times a year and, from the second report onwards, leads with the only thing that has actually changed: what is new.\u003c\/p\u003e\u003ch3\u003eWhat's included\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eBreach \u0026amp; Identity Exposure Check\u003c\/strong\u003e ($39)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eDigital Footprint Report\u003c\/strong\u003e ($49)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eEmail Spoofing \u0026amp; BEC Check\u003c\/strong\u003e ($39)\u003c\/li\u003e\n\u003c\/ul\u003e\u003cp\u003e\u003cstrong\u003e$127 of scans per run. Annual plan: $99 for four runs — $25 a quarter.\u003c\/strong\u003e\u003c\/p\u003e\u003ch3\u003eWhy this one is annual only\u003c\/h3\u003e\u003cp\u003eThis is the deliberately lopsided product in the range. A single run of these three scans is already sold as the \u003cstrong\u003eIdentity \u0026amp; Email Exposure Pack\u003c\/strong\u003e at $89. Four runs with a quarter-by-quarter comparison cost $99. For $10 more you get four times the coverage, because exposure is the one risk area where a snapshot ages faster than anything else — so if you only want one look, buy the pack; if you want to actually know, buy this.\u003c\/p\u003e\u003ch3\u003eHow the annual plan works\u003c\/h3\u003e\u003cp\u003eThe first run happens when you are ready. The launcher schedules itself every 90 days using the answers you already gave. Four reports over twelve months.\u003c\/p\u003e\u003ch3\u003eWhat you get, every quarter\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003eOne written PDF report emailed back to you, typically within one business day of each run.\u003c\/li\u003e\n\u003cli\u003eA \"what's new since last time\" section at the front — new breaches, new paste hits, new subdomains, new public footprint.\u003c\/li\u003e\n\u003cli\u003eA visual exposure map you can compare quarter to quarter.\u003c\/li\u003e\n\u003cli\u003eAn impersonation and account-takeover risk picture combining all three scans.\u003c\/li\u003e\n\u003cli\u003eA prioritised action list: what to change, what to redact, what to publish.\u003c\/li\u003e\n\u003cli\u003eReporting built to CompTIA Security+ and PenTest+ practice standards.\u003c\/li\u003e\n\u003c\/ul\u003e\u003ch3\u003eRequirements\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003eWindows 10 or Windows 11\u003c\/li\u003e\n\u003cli\u003eRun as administrator\u003c\/li\u003e\n\u003cli\u003eAn internet connection\u003c\/li\u003e\n\u003cli\u003eThe email addresses, domain and usernames you want watched — they must be yours\u003c\/li\u003e\n\u003cli\u003eAbout 20 minutes for the first run; later runs are unattended\u003c\/li\u003e\n\u003c\/ul\u003e\u003ch3\u003eWhat this is not\u003c\/h3\u003e\u003cp\u003eQuickScan is detection and advisory only. It searches public records; it does not buy data, access criminal marketplaces on your behalf, or change anything. It is not continuous monitoring — it is four scheduled checks a year with a written analysis each time. It is not a certification, an audit or an attestation.\u003c\/p\u003e\u003cp\u003e\u003csmall\u003eYour report is prepared with AI-assisted analysis under ThreatVector's security review protocols and checked against our false-positive triage rules before it is sent. Reports are produced by ThreatVector LLC. ThreatVector and its scan library are developed, sold and distributed by ThreatVector LLC.\u003c\/small\u003e\u003c\/p\u003e","brand":"ThreatVector","offers":[{"title":"Annual Plan – 4 quarterly runs","offer_id":52913671209272,"sku":"QTR-IDENTITY-34","price":99.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1011\/7123\/3080\/files\/card-QTR-IDENTITY-34_a1b96cc0-fd4a-44ef-8085-3f5a457a37b5.png?v=1788709378"},{"product_id":"quickscan-quarterly-business-checkup","title":"Quarterly Business Checkup – 10 Scans, Every 90 Days, Insurance-Ready","description":"\u003cp\u003e\u003cstrong\u003eThe whole business, checked four times a year, documented in writing.\u003c\/strong\u003e\u003c\/p\u003e\u003cp\u003eThe Quarterly Business Checkup is the recurring anchor of the QuickScan range: ten scans spanning your computers, your perimeter, your email domain and your identity exposure, repeated every 90 days, with each report showing what closed and what opened since the last one.\u003c\/p\u003e\u003ch3\u003eWhat's included\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eWindows Security Health Check\u003c\/strong\u003e ($29)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRansomware Readiness Check\u003c\/strong\u003e ($39)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAccount \u0026amp; Access Review\u003c\/strong\u003e ($39)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eOut-of-Date Software Scan\u003c\/strong\u003e ($19)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eStartup \u0026amp; Persistence Check\u003c\/strong\u003e ($39)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eInternet Exposure Scan\u003c\/strong\u003e ($69)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eEmail Spoofing \u0026amp; BEC Check\u003c\/strong\u003e ($39)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eCertificate \u0026amp; Encryption Check\u003c\/strong\u003e ($19)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eBreach \u0026amp; Identity Exposure Check\u003c\/strong\u003e ($39)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eInsider Risk Self-Assessment\u003c\/strong\u003e ($39)\u003c\/li\u003e\n\u003c\/ul\u003e\u003cp\u003e\u003cstrong\u003e$370 of scans per run. Annual plan: $599 for four runs — $150 a quarter.\u003c\/strong\u003e\u003c\/p\u003e\u003ch3\u003eWhat it replaces\u003c\/h3\u003e\u003cp\u003eAn IT provider charges $1,000–$2,000 for one automated vulnerability assessment and $2,000–$4,000 for a standard one. A lightweight virtual-CISO retainer that includes quarterly reviews runs $2,000 a month and up. This is four documented reviews a year for $599 — automated, run on your own machine, and producing exactly the multi-factor, backup and patching evidence a cyber-insurance application asks for. A business already paying a four-figure annual premium is buying the evidence that keeps that policy honest.\u003c\/p\u003e\u003ch3\u003eHow the annual plan works\u003c\/h3\u003e\u003cp\u003eThe first run happens when you are ready. The launcher schedules itself every 90 days using the answers you already gave. Four reports over twelve months, each compared against the last.\u003c\/p\u003e\u003ch3\u003eWhat you get, every quarter\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003eOne written PDF report emailed back to you, typically within one business day of each run.\u003c\/li\u003e\n\u003cli\u003eA score for every surface — endpoint, network, perimeter, email, identity — plus a combined business picture.\u003c\/li\u003e\n\u003cli\u003eA resolved \/ still open \/ newly found comparison against your previous run.\u003c\/li\u003e\n\u003cli\u003eAttack-chain analysis across all ten scans, showing how separate findings assemble into a real intrusion path.\u003c\/li\u003e\n\u003cli\u003eAn executive summary written for an owner, a board or an insurer.\u003c\/li\u003e\n\u003cli\u003eA 90-day security programme, re-prioritised each quarter.\u003c\/li\u003e\n\u003cli\u003eReporting built to CompTIA Security+ and PenTest+ practice standards.\u003c\/li\u003e\n\u003c\/ul\u003e\u003ch3\u003eChoosing your option\u003c\/h3\u003e\u003cp\u003e\u003cstrong\u003eAnnual Plan\u003c\/strong\u003e — four scheduled runs over twelve months with trend reporting. \u003cstrong\u003eSingle Run\u003c\/strong\u003e — one run, one report, no scheduling.\u003c\/p\u003e\u003ch3\u003eRequirements\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003eWindows 10 or Windows 11\u003c\/li\u003e\n\u003cli\u003eRun as administrator\u003c\/li\u003e\n\u003cli\u003eAn internet connection\u003c\/li\u003e\n\u003cli\u003eYour domain and public address — you must own them or be authorised to test them\u003c\/li\u003e\n\u003cli\u003eAbout 50 minutes for the first run; later runs are unattended\u003c\/li\u003e\n\u003c\/ul\u003e\u003ch3\u003eWhat this is not\u003c\/h3\u003e\u003cp\u003eQuickScan is detection and advisory only. Nothing here exploits a weakness or changes a setting. Part of the Insider Risk assessment is based on your own answers, and the report states which findings came from you rather than from observation. It is not a certification, an audit, an attestation, or insurance advice — if a report surfaces a complete attack path, it says so and points you to ThreatVector's hands-on engagement.\u003c\/p\u003e\u003cp\u003e\u003csmall\u003eYour report is prepared with AI-assisted analysis under ThreatVector's security review protocols and checked against our false-positive triage rules before it is sent. Reports are produced by ThreatVector LLC. ThreatVector and its scan library are developed, sold and distributed by ThreatVector LLC.\u003c\/small\u003e\u003c\/p\u003e","brand":"ThreatVector","offers":[{"title":"Annual Plan – 4 quarterly runs","offer_id":52913671242040,"sku":"QTR-BUSINESS-35","price":599.0,"currency_code":"USD","in_stock":true},{"title":"Single Run","offer_id":52913671274808,"sku":"QTR-BUSINESS-35-1RUN","price":199.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1011\/7123\/3080\/files\/card-QTR-BUSINESS-35_eff7db9d-95b0-4807-975d-789028f64ace.png?v=1788709378"},{"product_id":"faith-community-hardening-bundle","title":"Quarterly Faith Community Hardening","description":"\u003cp\u003e\u003cem\u003eEvery 90 days, with a trend line on every check.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch3\u003eWhat it is\u003c\/h3\u003e\n\u003cp\u003eRuns eighteen checks on this computer, the network it is on, the smart devices on it and the domains you declare, asks your congregation's questions once, and maps everything to NIST CSF 2.0 in one report. Nothing is changed.\u003c\/p\u003e\n\u003cp\u003eThe scams aimed at a congregation wear the clergy's name: a gift-card request to a volunteer, a changed account for a contractor, a hijacked livestream. This bundle gathers what one office can show: its computers and Wi-Fi, the smart devices on the network, your giving page, website and domain, the clergy's public footprint, the doors donor records could leave through, and your own answers.\u003c\/p\u003e\n\u003cp\u003eThis is the quarterly form of the Faith Community Hardening Bundle (IND-FAITH-89): the same 18 checks, run four times a year, each report showing what changed since the last.\u003c\/p\u003e\n\u003ch3\u003eThe framework\u003c\/h3\u003e\n\u003cp\u003eMapped to NIST CSF 2.0 — with CISA's Performance Goals and PCI DSS by reference. The report maps what the scan observed on this computer, this network and the domains you declare to that framework's expectations and shows where each finding sits. It is a map of findings to the framework, not a ruling on whether you meet it, and it is not a risk analysis; your industry's expectations stand beside the findings, never in place of them.\u003c\/p\u003e\n\u003ch3\u003eWho it is for\u003c\/h3\u003e\n\u003cp\u003eA church, synagogue, mosque, temple, parish or the small office of a diocese or regional body, with its own computers and domain. A denomination's headquarters or a diocese with many parishes is measured across every office and is the human-delivered engagement's customer; this bundle is one congregation's first look.\u003c\/p\u003e\n\u003cp\u003eA denomination's headquarters or a diocese is measured across every parish office, every shared system and every giving platform it runs for its congregations. That is the work of the human-delivered ThreatVector engagement. This report is still correct about the office computer it ran on and is a useful first look for the administrator who ran it.\u003c\/p\u003e\n\u003ch3\u003eWhat runs (18 checks)\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eWindows Security Health Check (ENDPOINT-01)\u003c\/li\u003e\n\u003cli\u003eRansomware Readiness Check (RANSOM-READY-03)\u003c\/li\u003e\n\u003cli\u003eCredential Hygiene Check (PW-HYGIENE-11)\u003c\/li\u003e\n\u003cli\u003eOut-of-Date Software Scan (EOL-16)\u003c\/li\u003e\n\u003cli\u003eStartup \u0026amp; Persistence Check (PERSIST-24)\u003c\/li\u003e\n\u003cli\u003eWi-Fi \u0026amp; Home Network Check (WIFI-LAN-02)\u003c\/li\u003e\n\u003cli\u003eRouter \u0026amp; Wi-Fi Settings Checklist (ROUTER-22)\u003c\/li\u003e\n\u003cli\u003eEmail Spoofing \u0026amp; BEC Check (BEC-08)\u003c\/li\u003e\n\u003cli\u003eBreach \u0026amp; Identity Exposure Check (BREACH-10)\u003c\/li\u003e\n\u003cli\u003eIndustry Readiness Questionnaire (READINESS-91)\u003c\/li\u003e\n\u003cli\u003eBusiness Impersonation \u0026amp; Typosquat Sweep (IMPERSON-19)\u003c\/li\u003e\n\u003cli\u003eDigital Footprint Report (FOOTPRINT-12)\u003c\/li\u003e\n\u003cli\u003eWebsite \u0026amp; Storefront Checkup (STOREFRONT-07)\u003c\/li\u003e\n\u003cli\u003eCertificate \u0026amp; Encryption Check (TLS-09)\u003c\/li\u003e\n\u003cli\u003eDomain \u0026amp; DNS Security Check (DNS-63)\u003c\/li\u003e\n\u003cli\u003eSmart Device Exposure Scan (IOT-04)\u003c\/li\u003e\n\u003cli\u003eCloud Storage Exposure Check (BUCKET-28)\u003c\/li\u003e\n\u003cli\u003eRemovable Media \u0026amp; Cloud Sync Check (DATAEXIT-76)\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eBefore it runs: one question you can say no to\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMay the Removable Media \u0026amp; Cloud Sync Check also read which cloud-sync clients are installed on this computer and which of your folders they hold? It never signs in to any account and never reads a file. Optional. Say no and the report records that this check was skipped at your request.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003ePrice\u003c\/h3\u003e\n\u003cp\u003e\u003cstrong\u003e$399 a year\u003c\/strong\u003e, four runs, one every 90 days, with a trend line on every check from the second run. One run on its own is \u003cstrong\u003e$299\u003c\/strong\u003e: the Faith Community Hardening Bundle (IND-FAITH-89).\u003c\/p\u003e\n\u003ch3\u003eWhat it never does\u003c\/h3\u003e\n\u003cp\u003eIt never changes a setting, installs anything, tries a password or signs in to an account. Where a check reads inside files it reports counts only — never a value, a file name or a path. Nothing is exploited and no credential is guessed. Your own answers are recorded as yours and never upgraded into something the scan observed.\u003c\/p\u003e","brand":"ThreatVector","offers":[{"title":"Default Title","offer_id":53138386944312,"sku":"IND-FAITH-Q-89","price":399.0,"currency_code":"USD","in_stock":false}]},{"product_id":"healthcare-practice-hardening-bundle","title":"Quarterly Healthcare Practice Hardening","description":"\u003cp\u003e\u003cem\u003eEvery 90 days, with a trend line on every check.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch3\u003eWhat it is\u003c\/h3\u003e\n\u003cp\u003eRuns twenty-four checks on this computer, the network it is on and the domains you declare, asks your practice's questions once, and maps everything to the HIPAA Security Rule in one report. Nothing is changed.\u003c\/p\u003e\n\u003cp\u003eA practice is measured against the Security Rule's safeguards, and the first thing an investigator or compliance reviewer asks for is evidence. This bundle gathers the evidence one workstation can give: its settings, the devices sharing its network, the patient data at rest and the doors it could leave through, your domain and e-mail, and your own answers to the questions no scan can see.\u003c\/p\u003e\n\u003cp\u003eThis is the quarterly form of the Healthcare Practice Hardening Bundle (IND-HEALTH-80): the same 24 checks, run four times a year, each report showing what changed since the last.\u003c\/p\u003e\n\u003ch3\u003eThe framework\u003c\/h3\u003e\n\u003cp\u003eMapped to the HIPAA Security Rule — with the HHS Health Industry Cybersecurity Practices. The report maps what the scan observed on this computer, this network and the domains you declare to that framework's expectations and shows where each finding sits. It is a map of findings to the framework, not a ruling on whether you meet it, and it is not a risk analysis; your industry's expectations stand beside the findings, never in place of them.\u003c\/p\u003e\n\u003ch3\u003eWho it is for\u003c\/h3\u003e\n\u003cp\u003eA practice, clinic, dental or therapy office, pharmacy or home-health agency with its own computers and its own domain; a hospital department only for the workstations it owns. A hospital or health system is measured organisation-wide and is the human-delivered engagement's customer; this bundle is its first look at one workstation.\u003c\/p\u003e\n\u003cp\u003eA hospital or health system is measured across every department, every connected device and every business associate, with a risk analysis that covers the enterprise. That is the work of the human-delivered ThreatVector engagement. This report is still correct about the workstation it ran on and is a useful first look for the IT lead who ran it.\u003c\/p\u003e\n\u003ch3\u003eWhat runs (24 checks)\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eWindows Security Health Check (ENDPOINT-01)\u003c\/li\u003e\n\u003cli\u003eRansomware Readiness Check (RANSOM-READY-03)\u003c\/li\u003e\n\u003cli\u003eAccount \u0026amp; Access Review (INSIDER-ACCESS-05)\u003c\/li\u003e\n\u003cli\u003eCredential Hygiene Check (PW-HYGIENE-11)\u003c\/li\u003e\n\u003cli\u003eOut-of-Date Software Scan (EOL-16)\u003c\/li\u003e\n\u003cli\u003eStartup \u0026amp; Persistence Check (PERSIST-24)\u003c\/li\u003e\n\u003cli\u003eWi-Fi \u0026amp; Home Network Check (WIFI-LAN-02)\u003c\/li\u003e\n\u003cli\u003eRouter \u0026amp; Wi-Fi Settings Checklist (ROUTER-22)\u003c\/li\u003e\n\u003cli\u003eEmail Spoofing \u0026amp; BEC Check (BEC-08)\u003c\/li\u003e\n\u003cli\u003eBreach \u0026amp; Identity Exposure Check (BREACH-10)\u003c\/li\u003e\n\u003cli\u003eInsider Risk Self-Assessment (INSIDER-21)\u003c\/li\u003e\n\u003cli\u003eIndustry Readiness Questionnaire (READINESS-91)\u003c\/li\u003e\n\u003cli\u003eInternet Exposure Scan (EXPOSURE-06)\u003c\/li\u003e\n\u003cli\u003eWebsite \u0026amp; Storefront Checkup (STOREFRONT-07)\u003c\/li\u003e\n\u003cli\u003eCertificate \u0026amp; Encryption Check (TLS-09)\u003c\/li\u003e\n\u003cli\u003eDomain \u0026amp; DNS Security Check (DNS-63)\u003c\/li\u003e\n\u003cli\u003eMedical \u0026amp; Operational Device Scan (DEVICES-77)\u003c\/li\u003e\n\u003cli\u003eSensitive Data at Rest Check (SENSDATA-78)\u003c\/li\u003e\n\u003cli\u003eRemovable Media \u0026amp; Cloud Sync Check (DATAEXIT-76)\u003c\/li\u003e\n\u003cli\u003eWorkstation Policy \u0026amp; Logging Check (POLICY-79)\u003c\/li\u003e\n\u003cli\u003eCloud Storage Exposure Check (BUCKET-28)\u003c\/li\u003e\n\u003cli\u003eOrganizational Breach \u0026amp; Exposure History (ORGHIST-75)\u003c\/li\u003e\n\u003cli\u003eAI Usage \u0026amp; Shadow-AI Exposure Review (AIUSE-70)\u003c\/li\u003e\n\u003cli\u003eActive Directory Health Check (ADHEALTH-26) — runs only when you give the Windows domain this computer is joined to (leave blank if it is not joined to one)\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eBefore it runs: two questions you can say no to\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMay the Removable Media \u0026amp; Cloud Sync Check also read which cloud-sync clients are installed on this computer and which of your folders they hold? It never signs in to any account and never reads a file. Optional. Say no and the report records that this check was skipped at your request.\u003c\/li\u003e\n\u003cli\u003eMay the Sensitive Data at Rest Check count files in this computer's profile folders whose contents match regulated-data patterns (such as Social Security or medical record number shapes)? It reports counts only: never a match, a file name or a path. Optional. Say no and the report records that this check was skipped at your request.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003ePrice\u003c\/h3\u003e\n\u003cp\u003e\u003cstrong\u003e$699 a year\u003c\/strong\u003e, four runs, one every 90 days, with a trend line on every check from the second run. One run on its own is \u003cstrong\u003e$549\u003c\/strong\u003e: the Healthcare Practice Hardening Bundle (IND-HEALTH-80).\u003c\/p\u003e\n\u003ch3\u003eWhat it never does\u003c\/h3\u003e\n\u003cp\u003eIt never changes a setting, installs anything, tries a password or signs in to an account. Where a check reads inside files it reports counts only — never a value, a file name or a path. Nothing is exploited and no credential is guessed. Your own answers are recorded as yours and never upgraded into something the scan observed.\u003c\/p\u003e","brand":"ThreatVector","offers":[{"title":"Default Title","offer_id":53138387534136,"sku":"IND-HEALTH-Q-80","price":699.0,"currency_code":"USD","in_stock":false}]},{"product_id":"financial-services-hardening-bundle","title":"Quarterly Financial Services Hardening","description":"\u003cp\u003e\u003cem\u003eEvery 90 days, with a trend line on every check.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch3\u003eWhat it is\u003c\/h3\u003e\n\u003cp\u003eRuns twenty-five checks on this computer, the network it is on and the domains you declare, asks your firm's questions once, and maps everything to the FTC Safeguards Rule in one report. Nothing is changed.\u003c\/p\u003e\n\u003cp\u003eA mortgage broker, insurance agency, tax firm or adviser is a financial institution under the Safeguards Rule, and an FTC investigator, your examiner or your insurer's reviewer asks first for evidence of the written program. This bundle gathers what one workstation can show: its settings, the customer information at rest and the doors it could leave through, your domain and look-alike domains, and your own answers.\u003c\/p\u003e\n\u003cp\u003eThis is the quarterly form of the Financial Services Hardening Bundle (IND-FINANCE-81): the same 25 checks, run four times a year, each report showing what changed since the last.\u003c\/p\u003e\n\u003ch3\u003eThe framework\u003c\/h3\u003e\n\u003cp\u003eMapped to the FTC Safeguards Rule — with NIST CSF 2.0 and PCI DSS by reference. The report maps what the scan observed on this computer, this network and the domains you declare to that framework's expectations and shows where each finding sits. It is a map of findings to the framework, not a ruling on whether you meet it, and it is not a risk analysis; your industry's expectations stand beside the findings, never in place of them.\u003c\/p\u003e\n\u003ch3\u003eWho it is for\u003c\/h3\u003e\n\u003cp\u003eThe non-bank office: a mortgage broker or lender, insurance agency, tax or accounting firm, adviser or collection agency with its own computers and domain. A bank or credit union is examined organisation-wide by its federal regulator and is the human-delivered engagement's customer; this bundle is its first look at one workstation.\u003c\/p\u003e\n\u003cp\u003eA bank or credit union is examined by its regulator across every branch, system and vendor, against NIST CSF 2.0, the CRI Profile and the regulator's own handbooks. That is the work of the human-delivered ThreatVector engagement. This report is still correct about the workstation it ran on and is a useful first look for the IT lead who ran it.\u003c\/p\u003e\n\u003ch3\u003eWhat runs (25 checks)\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eWindows Security Health Check (ENDPOINT-01)\u003c\/li\u003e\n\u003cli\u003eRansomware Readiness Check (RANSOM-READY-03)\u003c\/li\u003e\n\u003cli\u003eAccount \u0026amp; Access Review (INSIDER-ACCESS-05)\u003c\/li\u003e\n\u003cli\u003eCredential Hygiene Check (PW-HYGIENE-11)\u003c\/li\u003e\n\u003cli\u003eOut-of-Date Software Scan (EOL-16)\u003c\/li\u003e\n\u003cli\u003eStartup \u0026amp; Persistence Check (PERSIST-24)\u003c\/li\u003e\n\u003cli\u003eWi-Fi \u0026amp; Home Network Check (WIFI-LAN-02)\u003c\/li\u003e\n\u003cli\u003eRouter \u0026amp; Wi-Fi Settings Checklist (ROUTER-22)\u003c\/li\u003e\n\u003cli\u003eEmail Spoofing \u0026amp; BEC Check (BEC-08)\u003c\/li\u003e\n\u003cli\u003eBreach \u0026amp; Identity Exposure Check (BREACH-10)\u003c\/li\u003e\n\u003cli\u003eInsider Risk Self-Assessment (INSIDER-21)\u003c\/li\u003e\n\u003cli\u003eIndustry Readiness Questionnaire (READINESS-91)\u003c\/li\u003e\n\u003cli\u003eInternet Exposure Scan (EXPOSURE-06)\u003c\/li\u003e\n\u003cli\u003eWebsite \u0026amp; Storefront Checkup (STOREFRONT-07)\u003c\/li\u003e\n\u003cli\u003eCertificate \u0026amp; Encryption Check (TLS-09)\u003c\/li\u003e\n\u003cli\u003eDomain \u0026amp; DNS Security Check (DNS-63)\u003c\/li\u003e\n\u003cli\u003eSensitive Data at Rest Check (SENSDATA-78)\u003c\/li\u003e\n\u003cli\u003eRemovable Media \u0026amp; Cloud Sync Check (DATAEXIT-76)\u003c\/li\u003e\n\u003cli\u003eWorkstation Policy \u0026amp; Logging Check (POLICY-79)\u003c\/li\u003e\n\u003cli\u003eCloud Storage Exposure Check (BUCKET-28)\u003c\/li\u003e\n\u003cli\u003eBusiness Impersonation \u0026amp; Typosquat Sweep (IMPERSON-19)\u003c\/li\u003e\n\u003cli\u003eOrganizational Breach \u0026amp; Exposure History (ORGHIST-75)\u003c\/li\u003e\n\u003cli\u003eAI Usage \u0026amp; Shadow-AI Exposure Review (AIUSE-70)\u003c\/li\u003e\n\u003cli\u003eDigital Asset Register \u0026amp; Ownership Check (REGISTER-74)\u003c\/li\u003e\n\u003cli\u003eActive Directory Health Check (ADHEALTH-26) — runs only when you give the Windows domain this computer is joined to (leave blank if it is not joined to one)\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eBefore it runs: two questions you can say no to\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMay the Removable Media \u0026amp; Cloud Sync Check also read which cloud-sync clients are installed on this computer and which of your folders they hold? It never signs in to any account and never reads a file. Optional. Say no and the report records that this check was skipped at your request.\u003c\/li\u003e\n\u003cli\u003eMay the Sensitive Data at Rest Check count files in this computer's profile folders whose contents match regulated-data patterns (such as Social Security, card or account number shapes)? It reports counts only: never a match, a file name or a path. Optional. Say no and the report records that this check was skipped at your request.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003ePrice\u003c\/h3\u003e\n\u003cp\u003e\u003cstrong\u003e$699 a year\u003c\/strong\u003e, four runs, one every 90 days, with a trend line on every check from the second run. One run on its own is \u003cstrong\u003e$549\u003c\/strong\u003e: the Financial Services Hardening Bundle (IND-FINANCE-81).\u003c\/p\u003e\n\u003ch3\u003eWhat it never does\u003c\/h3\u003e\n\u003cp\u003eIt never changes a setting, installs anything, tries a password or signs in to an account. Where a check reads inside files it reports counts only — never a value, a file name or a path. Nothing is exploited and no credential is guessed. Your own answers are recorded as yours and never upgraded into something the scan observed.\u003c\/p\u003e","brand":"ThreatVector","offers":[{"title":"Default Title","offer_id":53138388287800,"sku":"IND-FINANCE-Q-81","price":699.0,"currency_code":"USD","in_stock":false}]},{"product_id":"real-estate-office-hardening-bundle","title":"Quarterly Real Estate Office Hardening","description":"\u003cp\u003e\u003cem\u003eEvery 90 days, with a trend line on every check.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch3\u003eWhat it is\u003c\/h3\u003e\n\u003cp\u003eRuns twenty-two checks on this computer, the network it is on and the domains you declare, asks your brokerage's questions once, and maps everything to NIST CSF 2.0 in one report. Nothing is changed.\u003c\/p\u003e\n\u003cp\u003eA closing is lost to one forged e-mail with new wiring instructions, and your clients and your insurer ask how the brokerage verifies a wire, stands against a look-alike domain and handles agents' devices. This bundle gathers what one office can show: its computers, the doors transaction records could leave through, your domain and the domains one letter from it, your principals' public footprint, and your own answers.\u003c\/p\u003e\n\u003cp\u003eThis is the quarterly form of the Real Estate Office Hardening Bundle (IND-REALTY-82): the same 22 checks, run four times a year, each report showing what changed since the last.\u003c\/p\u003e\n\u003ch3\u003eThe framework\u003c\/h3\u003e\n\u003cp\u003eMapped to NIST CSF 2.0 — with the FTC Safeguards Rule by reference. The report maps what the scan observed on this computer, this network and the domains you declare to that framework's expectations and shows where each finding sits. It is a map of findings to the framework, not a ruling on whether you meet it, and it is not a risk analysis; your industry's expectations stand beside the findings, never in place of them.\u003c\/p\u003e\n\u003ch3\u003eWho it is for\u003c\/h3\u003e\n\u003cp\u003eA brokerage, an agent's office, a property-management company or a title and escrow office with its own computers and domain. A national brokerage or franchise network is measured across its offices and is the human-delivered engagement's customer; this bundle is one office's first look.\u003c\/p\u003e\n\u003cp\u003eA national brokerage, franchise network or title company is measured across every office, platform and affiliated agent. That is the work of the human-delivered ThreatVector engagement. This report is still correct about the office computer it ran on and is a useful first look for the broker who ran it.\u003c\/p\u003e\n\u003ch3\u003eWhat runs (22 checks)\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eWindows Security Health Check (ENDPOINT-01)\u003c\/li\u003e\n\u003cli\u003eRansomware Readiness Check (RANSOM-READY-03)\u003c\/li\u003e\n\u003cli\u003eAccount \u0026amp; Access Review (INSIDER-ACCESS-05)\u003c\/li\u003e\n\u003cli\u003eCredential Hygiene Check (PW-HYGIENE-11)\u003c\/li\u003e\n\u003cli\u003eOut-of-Date Software Scan (EOL-16)\u003c\/li\u003e\n\u003cli\u003eStartup \u0026amp; Persistence Check (PERSIST-24)\u003c\/li\u003e\n\u003cli\u003eWi-Fi \u0026amp; Home Network Check (WIFI-LAN-02)\u003c\/li\u003e\n\u003cli\u003eRouter \u0026amp; Wi-Fi Settings Checklist (ROUTER-22)\u003c\/li\u003e\n\u003cli\u003eEmail Spoofing \u0026amp; BEC Check (BEC-08)\u003c\/li\u003e\n\u003cli\u003eBreach \u0026amp; Identity Exposure Check (BREACH-10)\u003c\/li\u003e\n\u003cli\u003eInsider Risk Self-Assessment (INSIDER-21)\u003c\/li\u003e\n\u003cli\u003eIndustry Readiness Questionnaire (READINESS-91)\u003c\/li\u003e\n\u003cli\u003eInternet Exposure Scan (EXPOSURE-06)\u003c\/li\u003e\n\u003cli\u003eWebsite \u0026amp; Storefront Checkup (STOREFRONT-07)\u003c\/li\u003e\n\u003cli\u003eCertificate \u0026amp; Encryption Check (TLS-09)\u003c\/li\u003e\n\u003cli\u003eDomain \u0026amp; DNS Security Check (DNS-63)\u003c\/li\u003e\n\u003cli\u003eBusiness Impersonation \u0026amp; Typosquat Sweep (IMPERSON-19)\u003c\/li\u003e\n\u003cli\u003eDigital Footprint Report (FOOTPRINT-12)\u003c\/li\u003e\n\u003cli\u003eTravel Connection \u0026amp; Device Safety Test (TRAVEL-72)\u003c\/li\u003e\n\u003cli\u003eCloud Storage Exposure Check (BUCKET-28)\u003c\/li\u003e\n\u003cli\u003eAI Usage \u0026amp; Shadow-AI Exposure Review (AIUSE-70)\u003c\/li\u003e\n\u003cli\u003eRemovable Media \u0026amp; Cloud Sync Check (DATAEXIT-76)\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eBefore it runs: one question you can say no to\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMay the Removable Media \u0026amp; Cloud Sync Check also read which cloud-sync clients are installed on this computer and which of your folders they hold? It never signs in to any account and never reads a file. Optional. Say no and the report records that this check was skipped at your request.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003ePrice\u003c\/h3\u003e\n\u003cp\u003e\u003cstrong\u003e$549 a year\u003c\/strong\u003e, four runs, one every 90 days, with a trend line on every check from the second run. One run on its own is \u003cstrong\u003e$449\u003c\/strong\u003e: the Real Estate Office Hardening Bundle (IND-REALTY-82).\u003c\/p\u003e\n\u003ch3\u003eWhat it never does\u003c\/h3\u003e\n\u003cp\u003eIt never changes a setting, installs anything, tries a password or signs in to an account. Where a check reads inside files it reports counts only — never a value, a file name or a path. Nothing is exploited and no credential is guessed. Your own answers are recorded as yours and never upgraded into something the scan observed.\u003c\/p\u003e","brand":"ThreatVector","offers":[{"title":"Default Title","offer_id":53138388877624,"sku":"IND-REALTY-Q-82","price":549.0,"currency_code":"USD","in_stock":false}]},{"product_id":"defense-contractor-readiness-bundle","title":"Quarterly Defense Contractor Readiness","description":"\u003cp\u003e\u003cem\u003eEvery 90 days, with a trend line on every check.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch3\u003eWhat it is\u003c\/h3\u003e\n\u003cp\u003eRuns twenty-five checks on this computer, the network it is on and the domains you declare, asks your contractor's questions once, and maps everything to NIST SP 800-171 Rev 2 in one report. Nothing is changed.\u003c\/p\u003e\n\u003cp\u003eA subcontractor with controlled information is held to 110 requirements, and the self-assessment is yours to make and affirm. This bundle shows what one workstation looks like against them: its logging and hardening, the controlled data at rest and the doors it could leave through, your domain and e-mail, your equipment and digital assets, and your own answers to the questions no scan can see.\u003c\/p\u003e\n\u003cp\u003eThis is the quarterly form of the Defense Contractor Readiness Bundle (IND-DEFENSE-83): the same 25 checks, run four times a year, each report showing what changed since the last.\u003c\/p\u003e\n\u003ch3\u003eThe framework\u003c\/h3\u003e\n\u003cp\u003eMapped to NIST SP 800-171 Rev 2 — with FAR 52.204-21 for Level 1. The report maps what the scan observed on this computer, this network and the domains you declare to that framework's expectations and shows where each finding sits. It is a map of findings to the framework, not a ruling on whether you meet it, and it is not a risk analysis; your industry's expectations stand beside the findings, never in place of them.\u003c\/p\u003e\n\u003ch3\u003eWho it is for\u003c\/h3\u003e\n\u003cp\u003eThe small subcontractor to the Department of War (formerly the Department of Defense) that handles Federal Contract Information or Controlled Unclassified Information and is preparing a CMMC Level 1 or Level 2 self-assessment. A prime contractor or a large program is measured across every enclave and flow-down and is the human-delivered engagement's customer; this bundle is one workstation's first look.\u003c\/p\u003e\n\u003cp\u003eA prime contractor or a large program is measured across every enclave, every flow-down and every system that stores, processes or transmits controlled information, with a System Security Plan that covers the whole. That is the work of the human-delivered ThreatVector engagement. This report is still correct about the workstation it ran on and is a useful first look for the person who will write or update that plan.\u003c\/p\u003e\n\u003ch3\u003eWhat runs (25 checks)\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eWindows Security Health Check (ENDPOINT-01)\u003c\/li\u003e\n\u003cli\u003eRansomware Readiness Check (RANSOM-READY-03)\u003c\/li\u003e\n\u003cli\u003eAccount \u0026amp; Access Review (INSIDER-ACCESS-05)\u003c\/li\u003e\n\u003cli\u003eCredential Hygiene Check (PW-HYGIENE-11)\u003c\/li\u003e\n\u003cli\u003eOut-of-Date Software Scan (EOL-16)\u003c\/li\u003e\n\u003cli\u003eStartup \u0026amp; Persistence Check (PERSIST-24)\u003c\/li\u003e\n\u003cli\u003eWi-Fi \u0026amp; Home Network Check (WIFI-LAN-02)\u003c\/li\u003e\n\u003cli\u003eRouter \u0026amp; Wi-Fi Settings Checklist (ROUTER-22)\u003c\/li\u003e\n\u003cli\u003eEmail Spoofing \u0026amp; BEC Check (BEC-08)\u003c\/li\u003e\n\u003cli\u003eBreach \u0026amp; Identity Exposure Check (BREACH-10)\u003c\/li\u003e\n\u003cli\u003eInsider Risk Self-Assessment (INSIDER-21)\u003c\/li\u003e\n\u003cli\u003eIndustry Readiness Questionnaire (READINESS-91)\u003c\/li\u003e\n\u003cli\u003eInternet Exposure Scan (EXPOSURE-06)\u003c\/li\u003e\n\u003cli\u003eWebsite \u0026amp; Storefront Checkup (STOREFRONT-07)\u003c\/li\u003e\n\u003cli\u003eCertificate \u0026amp; Encryption Check (TLS-09)\u003c\/li\u003e\n\u003cli\u003eDomain \u0026amp; DNS Security Check (DNS-63)\u003c\/li\u003e\n\u003cli\u003eWorkstation Policy \u0026amp; Logging Check (POLICY-79)\u003c\/li\u003e\n\u003cli\u003eRemovable Media \u0026amp; Cloud Sync Check (DATAEXIT-76)\u003c\/li\u003e\n\u003cli\u003eSensitive Data at Rest Check (SENSDATA-78)\u003c\/li\u003e\n\u003cli\u003eOrganizational Breach \u0026amp; Exposure History (ORGHIST-75)\u003c\/li\u003e\n\u003cli\u003eCloud Storage Exposure Check (BUCKET-28)\u003c\/li\u003e\n\u003cli\u003eAI Usage \u0026amp; Shadow-AI Exposure Review (AIUSE-70)\u003c\/li\u003e\n\u003cli\u003eDigital Asset Register \u0026amp; Ownership Check (REGISTER-74)\u003c\/li\u003e\n\u003cli\u003eHardware, Firmware \u0026amp; Removable-Media Check (ASSET-73)\u003c\/li\u003e\n\u003cli\u003eActive Directory Health Check (ADHEALTH-26) — runs only when you give the Windows domain this computer is joined to (leave blank if it is not joined to one)\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003eOffered separately, never run by this package: Linux Server Hardening Check (SERVER-25): a Linux product the Windows package engine cannot run on this computer; the report offers it.\u003c\/p\u003e\n\u003ch3\u003eBefore it runs: two questions you can say no to\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMay the Removable Media \u0026amp; Cloud Sync Check also read which cloud-sync clients are installed on this computer and which of your folders they hold? It never signs in to any account and never reads a file. Optional. Say no and the report records that this check was skipped at your request.\u003c\/li\u003e\n\u003cli\u003eMay the Sensitive Data at Rest Check count files in this computer's profile folders whose contents carry CUI markings or regulated-data patterns? It reports counts only: never a match, a file name or a path. Optional. Say no and the report records that this check was skipped at your request.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003ePrice\u003c\/h3\u003e\n\u003cp\u003e\u003cstrong\u003e$799 a year\u003c\/strong\u003e, four runs, one every 90 days, with a trend line on every check from the second run. One run on its own is \u003cstrong\u003e$649\u003c\/strong\u003e: the Defense Contractor Readiness Bundle (IND-DEFENSE-83).\u003c\/p\u003e\n\u003ch3\u003eWhat it never does\u003c\/h3\u003e\n\u003cp\u003eIt never changes a setting, installs anything, tries a password or signs in to an account. Where a check reads inside files it reports counts only — never a value, a file name or a path. Nothing is exploited and no credential is guessed. Your own answers are recorded as yours and never upgraded into something the scan observed.\u003c\/p\u003e","brand":"ThreatVector","offers":[{"title":"Default Title","offer_id":53138389205304,"sku":"IND-DEFENSE-Q-83","price":799.0,"currency_code":"USD","in_stock":false}]},{"product_id":"supply-chain-hardening-bundle","title":"Quarterly Supply Chain Hardening","description":"\u003cp\u003e\u003cem\u003eEvery 90 days, with a trend line on every check.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch3\u003eWhat it is\u003c\/h3\u003e\n\u003cp\u003eRuns twenty-three checks on this computer, the network it is on, the warehouse devices it can hear and the domains you declare, asks your operation's questions once, and maps everything to NIST CSF 2.0 in one report. Nothing is changed.\u003c\/p\u003e\n\u003cp\u003eA load is paid to a carrier who never existed, a warehouse system is locked the week before peak, and your shippers' questionnaires ask what you have in place. This bundle gathers what one site can show: its computers, the devices sharing its network, your domain and the look-alike domains used for carrier impersonation, your portal endpoint, your asset register, and your own answers.\u003c\/p\u003e\n\u003cp\u003eThis is the quarterly form of the Supply Chain Hardening Bundle (IND-LOGISTICS-84): the same 23 checks, run four times a year, each report showing what changed since the last.\u003c\/p\u003e\n\u003ch3\u003eThe framework\u003c\/h3\u003e\n\u003cp\u003eMapped to NIST CSF 2.0 — with CISA's Cybersecurity Performance Goals 2.0. The report maps what the scan observed on this computer, this network and the domains you declare to that framework's expectations and shows where each finding sits. It is a map of findings to the framework, not a ruling on whether you meet it, and it is not a risk analysis; your industry's expectations stand beside the findings, never in place of them.\u003c\/p\u003e\n\u003ch3\u003eWho it is for\u003c\/h3\u003e\n\u003cp\u003eA freight broker, third-party logistics provider, warehouse, small carrier or customs broker with its own computers and domain. A large 3PL, carrier network or port operator is measured across every site and system and is the human-delivered engagement's customer; this bundle is one site's first look.\u003c\/p\u003e\n\u003cp\u003eA large 3PL, carrier network or port operator is measured across every site, every integrated system and every partner connection. That is the work of the human-delivered ThreatVector engagement. This report is still correct about the computer and the network it ran on and is a useful first look for the operations lead who ran it.\u003c\/p\u003e\n\u003ch3\u003eWhat runs (23 checks)\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eWindows Security Health Check (ENDPOINT-01)\u003c\/li\u003e\n\u003cli\u003eRansomware Readiness Check (RANSOM-READY-03)\u003c\/li\u003e\n\u003cli\u003eAccount \u0026amp; Access Review (INSIDER-ACCESS-05)\u003c\/li\u003e\n\u003cli\u003eCredential Hygiene Check (PW-HYGIENE-11)\u003c\/li\u003e\n\u003cli\u003eOut-of-Date Software Scan (EOL-16)\u003c\/li\u003e\n\u003cli\u003eStartup \u0026amp; Persistence Check (PERSIST-24)\u003c\/li\u003e\n\u003cli\u003eWi-Fi \u0026amp; Home Network Check (WIFI-LAN-02)\u003c\/li\u003e\n\u003cli\u003eRouter \u0026amp; Wi-Fi Settings Checklist (ROUTER-22)\u003c\/li\u003e\n\u003cli\u003eEmail Spoofing \u0026amp; BEC Check (BEC-08)\u003c\/li\u003e\n\u003cli\u003eBreach \u0026amp; Identity Exposure Check (BREACH-10)\u003c\/li\u003e\n\u003cli\u003eInsider Risk Self-Assessment (INSIDER-21)\u003c\/li\u003e\n\u003cli\u003eIndustry Readiness Questionnaire (READINESS-91)\u003c\/li\u003e\n\u003cli\u003eInternet Exposure Scan (EXPOSURE-06)\u003c\/li\u003e\n\u003cli\u003eWebsite \u0026amp; Storefront Checkup (STOREFRONT-07)\u003c\/li\u003e\n\u003cli\u003eCertificate \u0026amp; Encryption Check (TLS-09)\u003c\/li\u003e\n\u003cli\u003eDomain \u0026amp; DNS Security Check (DNS-63)\u003c\/li\u003e\n\u003cli\u003eMedical \u0026amp; Operational Device Scan (DEVICES-77)\u003c\/li\u003e\n\u003cli\u003eBusiness Impersonation \u0026amp; Typosquat Sweep (IMPERSON-19)\u003c\/li\u003e\n\u003cli\u003eCloud Storage Exposure Check (BUCKET-28)\u003c\/li\u003e\n\u003cli\u003eAI Usage \u0026amp; Shadow-AI Exposure Review (AIUSE-70)\u003c\/li\u003e\n\u003cli\u003eDigital Asset Register \u0026amp; Ownership Check (REGISTER-74)\u003c\/li\u003e\n\u003cli\u003eHardware, Firmware \u0026amp; Removable-Media Check (ASSET-73)\u003c\/li\u003e\n\u003cli\u003eAPI \u0026amp; Web-Endpoint Security Scan (API-60) — runs only when you give the address of a web API you run, if any (optional)\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003ePrice\u003c\/h3\u003e\n\u003cp\u003e\u003cstrong\u003e$649 a year\u003c\/strong\u003e, four runs, one every 90 days, with a trend line on every check from the second run. One run on its own is \u003cstrong\u003e$499\u003c\/strong\u003e: the Supply Chain Hardening Bundle (IND-LOGISTICS-84).\u003c\/p\u003e\n\u003ch3\u003eWhat it never does\u003c\/h3\u003e\n\u003cp\u003eIt never changes a setting, installs anything, tries a password or signs in to an account. Where a check reads inside files it reports counts only — never a value, a file name or a path. Nothing is exploited and no credential is guessed. Your own answers are recorded as yours and never upgraded into something the scan observed.\u003c\/p\u003e","brand":"ThreatVector","offers":[{"title":"Default Title","offer_id":53138389303608,"sku":"IND-LOGISTICS-Q-84","price":649.0,"currency_code":"USD","in_stock":false}]},{"product_id":"manufacturing-plant-hardening-bundle","title":"Quarterly Manufacturing Plant Hardening","description":"\u003cp\u003e\u003cem\u003eEvery 90 days, with a trend line on every check.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch3\u003eWhat it is\u003c\/h3\u003e\n\u003cp\u003eRuns twenty-three checks on this office computer, the network it is on, the production devices it can hear and the domains you declare, asks your plant's questions once, and maps everything to the NIST Cybersecurity Framework Manufacturing Profile in one report. Nothing is changed.\u003c\/p\u003e\n\u003cp\u003eRansomware stops the line, and a customer's supplier questionnaire or your insurer asks whether the office and the floor share one network, who reaches the machines from outside, and what still runs on old Windows. This bundle gathers what one plant can show: its office computers, the devices sharing its network, the doors designs could leave through, your domain, and your own answers.\u003c\/p\u003e\n\u003cp\u003eThis is the quarterly form of the Manufacturing Plant Hardening Bundle (IND-MFG-85): the same 23 checks, run four times a year, each report showing what changed since the last.\u003c\/p\u003e\n\u003ch3\u003eThe framework\u003c\/h3\u003e\n\u003cp\u003eMapped to the NIST CSF Manufacturing Profile — with IEC 62443 by reference. The report maps what the scan observed on this computer, this network and the domains you declare to that framework's expectations and shows where each finding sits. It is a map of findings to the framework, not a ruling on whether you meet it, and it is not a risk analysis; your industry's expectations stand beside the findings, never in place of them.\u003c\/p\u003e\n\u003ch3\u003eWho it is for\u003c\/h3\u003e\n\u003cp\u003eA small to mid-size plant or machine shop with its own office computers and a production floor; a defence supplier is cross-sold the Defense Contractor Readiness Bundle. A multi-plant manufacturer is measured across every plant and production network and is the human-delivered engagement's customer; this bundle is one plant's first look.\u003c\/p\u003e\n\u003cp\u003eA multi-plant manufacturer is measured across every plant, every production network and every automation vendor's access, with zones and conduits drawn for the whole. That is the work of the human-delivered ThreatVector engagement. This report is still correct about the office computer and the network it ran on and is a useful first look for the plant manager who ran it.\u003c\/p\u003e\n\u003ch3\u003eWhat runs (23 checks)\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eWindows Security Health Check (ENDPOINT-01)\u003c\/li\u003e\n\u003cli\u003eRansomware Readiness Check (RANSOM-READY-03)\u003c\/li\u003e\n\u003cli\u003eAccount \u0026amp; Access Review (INSIDER-ACCESS-05)\u003c\/li\u003e\n\u003cli\u003eCredential Hygiene Check (PW-HYGIENE-11)\u003c\/li\u003e\n\u003cli\u003eOut-of-Date Software Scan (EOL-16)\u003c\/li\u003e\n\u003cli\u003eStartup \u0026amp; Persistence Check (PERSIST-24)\u003c\/li\u003e\n\u003cli\u003eWi-Fi \u0026amp; Home Network Check (WIFI-LAN-02)\u003c\/li\u003e\n\u003cli\u003eRouter \u0026amp; Wi-Fi Settings Checklist (ROUTER-22)\u003c\/li\u003e\n\u003cli\u003eEmail Spoofing \u0026amp; BEC Check (BEC-08)\u003c\/li\u003e\n\u003cli\u003eBreach \u0026amp; Identity Exposure Check (BREACH-10)\u003c\/li\u003e\n\u003cli\u003eInsider Risk Self-Assessment (INSIDER-21)\u003c\/li\u003e\n\u003cli\u003eIndustry Readiness Questionnaire (READINESS-91)\u003c\/li\u003e\n\u003cli\u003eInternet Exposure Scan (EXPOSURE-06)\u003c\/li\u003e\n\u003cli\u003eWebsite \u0026amp; Storefront Checkup (STOREFRONT-07)\u003c\/li\u003e\n\u003cli\u003eCertificate \u0026amp; Encryption Check (TLS-09)\u003c\/li\u003e\n\u003cli\u003eDomain \u0026amp; DNS Security Check (DNS-63)\u003c\/li\u003e\n\u003cli\u003eMedical \u0026amp; Operational Device Scan (DEVICES-77)\u003c\/li\u003e\n\u003cli\u003eRemovable Media \u0026amp; Cloud Sync Check (DATAEXIT-76)\u003c\/li\u003e\n\u003cli\u003eWorkstation Policy \u0026amp; Logging Check (POLICY-79)\u003c\/li\u003e\n\u003cli\u003eHardware, Firmware \u0026amp; Removable-Media Check (ASSET-73)\u003c\/li\u003e\n\u003cli\u003eDigital Asset Register \u0026amp; Ownership Check (REGISTER-74)\u003c\/li\u003e\n\u003cli\u003eAI Usage \u0026amp; Shadow-AI Exposure Review (AIUSE-70)\u003c\/li\u003e\n\u003cli\u003eActive Directory Health Check (ADHEALTH-26) — runs only when you give the Windows domain this computer is joined to (leave blank if it is not joined to one)\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003eOffered separately, never run by this package: Linux Server Hardening Check (SERVER-25): a Linux product the Windows package engine cannot run on this computer; the report offers it.\u003c\/p\u003e\n\u003ch3\u003eBefore it runs: one question you can say no to\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMay the Removable Media \u0026amp; Cloud Sync Check also read which cloud-sync clients are installed on this computer and which of your folders they hold? It never signs in to any account and never reads a file. Optional. Say no and the report records that this check was skipped at your request.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003ePrice\u003c\/h3\u003e\n\u003cp\u003e\u003cstrong\u003e$699 a year\u003c\/strong\u003e, four runs, one every 90 days, with a trend line on every check from the second run. One run on its own is \u003cstrong\u003e$549\u003c\/strong\u003e: the Manufacturing Plant Hardening Bundle (IND-MFG-85).\u003c\/p\u003e\n\u003ch3\u003eWhat it never does\u003c\/h3\u003e\n\u003cp\u003eIt never changes a setting, installs anything, tries a password or signs in to an account. Where a check reads inside files it reports counts only — never a value, a file name or a path. Nothing is exploited and no credential is guessed. Your own answers are recorded as yours and never upgraded into something the scan observed.\u003c\/p\u003e","brand":"ThreatVector","offers":[{"title":"Default Title","offer_id":53138389401912,"sku":"IND-MFG-Q-85","price":699.0,"currency_code":"USD","in_stock":false}]},{"product_id":"law-firm-hardening-bundle","title":"Quarterly Law Firm Hardening","description":"\u003cp\u003e\u003cem\u003eEvery 90 days, with a trend line on every check.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch3\u003eWhat it is\u003c\/h3\u003e\n\u003cp\u003eRuns twenty-five checks on this computer, the network it is on and the domains you declare, asks your firm's questions once, and maps everything to NIST CSF 2.0 with ISO\/IEC 27001 by reference, in one report. Nothing is changed.\u003c\/p\u003e\n\u003cp\u003eA firm's duty of confidentiality is tested by a wire-fraud e-mail, a stolen mailbox or a client file that left with a departure, and clients' outside-counsel guidelines ask for evidence of the controls. This bundle gathers what one office can show: its computers, the client data at rest and the doors it could leave through, your domain, e-mail and look-alike domains, and your own answers.\u003c\/p\u003e\n\u003cp\u003eThis is the quarterly form of the Law Firm Hardening Bundle (IND-LAW-86): the same 25 checks, run four times a year, each report showing what changed since the last.\u003c\/p\u003e\n\u003ch3\u003eThe framework\u003c\/h3\u003e\n\u003cp\u003eMapped to NIST CSF 2.0 — with ISO\/IEC 27001 by reference. The report maps what the scan observed on this computer, this network and the domains you declare to that framework's expectations and shows where each finding sits. It is a map of findings to the framework, not a ruling on whether you meet it, and it is not a risk analysis; your industry's expectations stand beside the findings, never in place of them.\u003c\/p\u003e\n\u003ch3\u003eWho it is for\u003c\/h3\u003e\n\u003cp\u003eA solo practitioner, a small or mid-size firm, or an in-house legal department with its own computers and domain. A large firm or the legal department of a large company is measured across every office and matter system and is the human-delivered engagement's customer; this bundle is one office's first look.\u003c\/p\u003e\n\u003cp\u003eA large firm or the legal department of a large company is measured across every office, matter system and client guideline, often to ISO\/IEC 27001 as a whole. That is the work of the human-delivered ThreatVector engagement. This report is still correct about the computer it ran on and is a useful first look for the partner or IT lead who ran it.\u003c\/p\u003e\n\u003ch3\u003eWhat runs (25 checks)\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eWindows Security Health Check (ENDPOINT-01)\u003c\/li\u003e\n\u003cli\u003eRansomware Readiness Check (RANSOM-READY-03)\u003c\/li\u003e\n\u003cli\u003eAccount \u0026amp; Access Review (INSIDER-ACCESS-05)\u003c\/li\u003e\n\u003cli\u003eCredential Hygiene Check (PW-HYGIENE-11)\u003c\/li\u003e\n\u003cli\u003eOut-of-Date Software Scan (EOL-16)\u003c\/li\u003e\n\u003cli\u003eStartup \u0026amp; Persistence Check (PERSIST-24)\u003c\/li\u003e\n\u003cli\u003eWi-Fi \u0026amp; Home Network Check (WIFI-LAN-02)\u003c\/li\u003e\n\u003cli\u003eRouter \u0026amp; Wi-Fi Settings Checklist (ROUTER-22)\u003c\/li\u003e\n\u003cli\u003eEmail Spoofing \u0026amp; BEC Check (BEC-08)\u003c\/li\u003e\n\u003cli\u003eBreach \u0026amp; Identity Exposure Check (BREACH-10)\u003c\/li\u003e\n\u003cli\u003eInsider Risk Self-Assessment (INSIDER-21)\u003c\/li\u003e\n\u003cli\u003eIndustry Readiness Questionnaire (READINESS-91)\u003c\/li\u003e\n\u003cli\u003eInternet Exposure Scan (EXPOSURE-06)\u003c\/li\u003e\n\u003cli\u003eWebsite \u0026amp; Storefront Checkup (STOREFRONT-07)\u003c\/li\u003e\n\u003cli\u003eCertificate \u0026amp; Encryption Check (TLS-09)\u003c\/li\u003e\n\u003cli\u003eDomain \u0026amp; DNS Security Check (DNS-63)\u003c\/li\u003e\n\u003cli\u003eSensitive Data at Rest Check (SENSDATA-78)\u003c\/li\u003e\n\u003cli\u003eRemovable Media \u0026amp; Cloud Sync Check (DATAEXIT-76)\u003c\/li\u003e\n\u003cli\u003eWorkstation Policy \u0026amp; Logging Check (POLICY-79)\u003c\/li\u003e\n\u003cli\u003eCloud Storage Exposure Check (BUCKET-28)\u003c\/li\u003e\n\u003cli\u003eBusiness Impersonation \u0026amp; Typosquat Sweep (IMPERSON-19)\u003c\/li\u003e\n\u003cli\u003eDigital Footprint Report (FOOTPRINT-12)\u003c\/li\u003e\n\u003cli\u003eAI Usage \u0026amp; Shadow-AI Exposure Review (AIUSE-70)\u003c\/li\u003e\n\u003cli\u003eTravel Connection \u0026amp; Device Safety Test (TRAVEL-72)\u003c\/li\u003e\n\u003cli\u003eActive Directory Health Check (ADHEALTH-26) — runs only when you give the Windows domain this computer is joined to (leave blank if it is not joined to one)\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eBefore it runs: two questions you can say no to\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMay the Removable Media \u0026amp; Cloud Sync Check also read which cloud-sync clients are installed on this computer and which of your folders they hold? It never signs in to any account and never reads a file. Optional. Say no and the report records that this check was skipped at your request.\u003c\/li\u003e\n\u003cli\u003eMay the Sensitive Data at Rest Check count files in this computer's profile folders whose contents match regulated-data patterns (such as Social Security, card or account number shapes)? It reports counts only: never a match, a file name or a path. Optional. Say no and the report records that this check was skipped at your request.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003ePrice\u003c\/h3\u003e\n\u003cp\u003e\u003cstrong\u003e$699 a year\u003c\/strong\u003e, four runs, one every 90 days, with a trend line on every check from the second run. One run on its own is \u003cstrong\u003e$549\u003c\/strong\u003e: the Law Firm Hardening Bundle (IND-LAW-86).\u003c\/p\u003e\n\u003ch3\u003eWhat it never does\u003c\/h3\u003e\n\u003cp\u003eIt never changes a setting, installs anything, tries a password or signs in to an account. Where a check reads inside files it reports counts only — never a value, a file name or a path. Nothing is exploited and no credential is guessed. Your own answers are recorded as yours and never upgraded into something the scan observed.\u003c\/p\u003e","brand":"ThreatVector","offers":[{"title":"Default Title","offer_id":53138389598520,"sku":"IND-LAW-Q-86","price":699.0,"currency_code":"USD","in_stock":false}]},{"product_id":"public-office-hardening-bundle","title":"Quarterly Public Office Hardening","description":"\u003cp\u003e\u003cem\u003eEvery 90 days, with a trend line on every check.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch3\u003eWhat it is\u003c\/h3\u003e\n\u003cp\u003eRuns twenty-seven checks on this computer, the network it is on, the devices it can hear and the domains you declare, asks your office's questions once, and maps everything to NIST CSF 2.0 in one report. Nothing is changed.\u003c\/p\u003e\n\u003cp\u003eA town, county, court or clerk's office is measured by its state, its insurer and the MS-ISAC review, and one forged payroll e-mail or a locked records system ends a resident's trust. This bundle gathers what one office can show: its workstations, the cameras and badge readers on its network, the records at rest and the doors they could leave through, your domain and website, and your own answers.\u003c\/p\u003e\n\u003cp\u003eThis is the quarterly form of the Public Office Hardening Bundle (IND-GOV-87): the same 27 checks, run four times a year, each report showing what changed since the last.\u003c\/p\u003e\n\u003ch3\u003eThe framework\u003c\/h3\u003e\n\u003cp\u003eMapped to NIST CSF 2.0 — with CISA's Performance Goals and the CJIS Security Policy by reference. The report maps what the scan observed on this computer, this network and the domains you declare to that framework's expectations and shows where each finding sits. It is a map of findings to the framework, not a ruling on whether you meet it, and it is not a risk analysis; your industry's expectations stand beside the findings, never in place of them.\u003c\/p\u003e\n\u003ch3\u003eWho it is for\u003c\/h3\u003e\n\u003cp\u003eA town, county, district, court, clerk's office or state field office with its own computers and domain. A state agency or a federal office is measured organisation-wide under its own framework and is the human-delivered engagement's customer; this bundle is one office's first look and its framework reference is still correct for the workstation it ran on.\u003c\/p\u003e\n\u003cp\u003eA state agency or a federal office is measured organisation-wide, under its state framework or under FISMA and NIST SP 800-53, with an authorisation that covers every system. That is the work of the human-delivered ThreatVector engagement. This report is still correct about the workstation it ran on and is a useful first look for the IT lead who ran it.\u003c\/p\u003e\n\u003ch3\u003eWhat runs (27 checks)\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eWindows Security Health Check (ENDPOINT-01)\u003c\/li\u003e\n\u003cli\u003eRansomware Readiness Check (RANSOM-READY-03)\u003c\/li\u003e\n\u003cli\u003eAccount \u0026amp; Access Review (INSIDER-ACCESS-05)\u003c\/li\u003e\n\u003cli\u003eCredential Hygiene Check (PW-HYGIENE-11)\u003c\/li\u003e\n\u003cli\u003eOut-of-Date Software Scan (EOL-16)\u003c\/li\u003e\n\u003cli\u003eStartup \u0026amp; Persistence Check (PERSIST-24)\u003c\/li\u003e\n\u003cli\u003eWi-Fi \u0026amp; Home Network Check (WIFI-LAN-02)\u003c\/li\u003e\n\u003cli\u003eRouter \u0026amp; Wi-Fi Settings Checklist (ROUTER-22)\u003c\/li\u003e\n\u003cli\u003eEmail Spoofing \u0026amp; BEC Check (BEC-08)\u003c\/li\u003e\n\u003cli\u003eBreach \u0026amp; Identity Exposure Check (BREACH-10)\u003c\/li\u003e\n\u003cli\u003eInsider Risk Self-Assessment (INSIDER-21)\u003c\/li\u003e\n\u003cli\u003eIndustry Readiness Questionnaire (READINESS-91)\u003c\/li\u003e\n\u003cli\u003eInternet Exposure Scan (EXPOSURE-06)\u003c\/li\u003e\n\u003cli\u003eWebsite \u0026amp; Storefront Checkup (STOREFRONT-07)\u003c\/li\u003e\n\u003cli\u003eCertificate \u0026amp; Encryption Check (TLS-09)\u003c\/li\u003e\n\u003cli\u003eDomain \u0026amp; DNS Security Check (DNS-63)\u003c\/li\u003e\n\u003cli\u003eWorkstation Policy \u0026amp; Logging Check (POLICY-79)\u003c\/li\u003e\n\u003cli\u003eRemovable Media \u0026amp; Cloud Sync Check (DATAEXIT-76)\u003c\/li\u003e\n\u003cli\u003eSensitive Data at Rest Check (SENSDATA-78)\u003c\/li\u003e\n\u003cli\u003eMedical \u0026amp; Operational Device Scan (DEVICES-77)\u003c\/li\u003e\n\u003cli\u003eBusiness Impersonation \u0026amp; Typosquat Sweep (IMPERSON-19)\u003c\/li\u003e\n\u003cli\u003eOrganizational Breach \u0026amp; Exposure History (ORGHIST-75)\u003c\/li\u003e\n\u003cli\u003eCloud Storage Exposure Check (BUCKET-28)\u003c\/li\u003e\n\u003cli\u003eAI Usage \u0026amp; Shadow-AI Exposure Review (AIUSE-70)\u003c\/li\u003e\n\u003cli\u003eDigital Asset Register \u0026amp; Ownership Check (REGISTER-74)\u003c\/li\u003e\n\u003cli\u003eHardware, Firmware \u0026amp; Removable-Media Check (ASSET-73)\u003c\/li\u003e\n\u003cli\u003eActive Directory Health Check (ADHEALTH-26) — runs only when you give the Windows domain this computer is joined to (leave blank if it is not joined to one)\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eBefore it runs: two questions you can say no to\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMay the Removable Media \u0026amp; Cloud Sync Check also read which cloud-sync clients are installed on this computer and which of your folders they hold? It never signs in to any account and never reads a file. Optional. Say no and the report records that this check was skipped at your request.\u003c\/li\u003e\n\u003cli\u003eMay the Sensitive Data at Rest Check count files in this computer's profile folders whose contents match regulated-data patterns (such as Social Security or account number shapes)? It reports counts only: never a match, a file name or a path. Optional. Say no and the report records that this check was skipped at your request.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003ePrice\u003c\/h3\u003e\n\u003cp\u003e\u003cstrong\u003e$699 a year\u003c\/strong\u003e, four runs, one every 90 days, with a trend line on every check from the second run. One run on its own is \u003cstrong\u003e$549\u003c\/strong\u003e: the Public Office Hardening Bundle (IND-GOV-87).\u003c\/p\u003e\n\u003ch3\u003eWhat it never does\u003c\/h3\u003e\n\u003cp\u003eIt never changes a setting, installs anything, tries a password or signs in to an account. Where a check reads inside files it reports counts only — never a value, a file name or a path. Nothing is exploited and no credential is guessed. Your own answers are recorded as yours and never upgraded into something the scan observed.\u003c\/p\u003e","brand":"ThreatVector","offers":[{"title":"Default Title","offer_id":53138389958968,"sku":"IND-GOV-Q-87","price":699.0,"currency_code":"USD","in_stock":false}]},{"product_id":"school-campus-hardening-bundle","title":"Quarterly School \u0026 Campus Hardening","description":"\u003cp\u003e\u003cem\u003eEvery 90 days, with a trend line on every check.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch3\u003eWhat it is\u003c\/h3\u003e\n\u003cp\u003eRuns twenty-three checks on this office computer, the network it is on, the classroom devices it can hear and the domains you declare, asks your school's questions once, and maps everything to NIST CSF 2.0 in one report. Nothing is changed.\u003c\/p\u003e\n\u003cp\u003eA locked student information system closes the school for days, and families, your state education department and your insurer ask how student records are kept, which vendors receive them and who can reach them. This bundle gathers what one school can show: its office computers, the classroom devices and cameras sharing its network, the student records at rest, your domain and e-mail, and your own answers.\u003c\/p\u003e\n\u003cp\u003eThis is the quarterly form of the School \u0026amp; Campus Hardening Bundle (IND-EDU-88): the same 23 checks, run four times a year, each report showing what changed since the last.\u003c\/p\u003e\n\u003ch3\u003eThe framework\u003c\/h3\u003e\n\u003cp\u003eMapped to NIST CSF 2.0 — with FERPA, CIPA and COPPA as expectations. The report maps what the scan observed on this computer, this network and the domains you declare to that framework's expectations and shows where each finding sits. It is a map of findings to the framework, not a ruling on whether you meet it, and it is not a risk analysis; your industry's expectations stand beside the findings, never in place of them.\u003c\/p\u003e\n\u003ch3\u003eWho it is for\u003c\/h3\u003e\n\u003cp\u003eA K-12 public, charter or private school, or a small college, with its own computers and domain. A large district or a university is measured across every campus and system and is the human-delivered engagement's customer; this bundle is one school's first look.\u003c\/p\u003e\n\u003cp\u003eA large district or a university is measured across every campus, every student system and every vendor that receives student records, with a program that covers the whole. That is the work of the human-delivered ThreatVector engagement. This report is still correct about the office computer it ran on and is a useful first look for the technology lead who ran it.\u003c\/p\u003e\n\u003ch3\u003eWhat runs (23 checks)\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eWindows Security Health Check (ENDPOINT-01)\u003c\/li\u003e\n\u003cli\u003eRansomware Readiness Check (RANSOM-READY-03)\u003c\/li\u003e\n\u003cli\u003eAccount \u0026amp; Access Review (INSIDER-ACCESS-05)\u003c\/li\u003e\n\u003cli\u003eCredential Hygiene Check (PW-HYGIENE-11)\u003c\/li\u003e\n\u003cli\u003eOut-of-Date Software Scan (EOL-16)\u003c\/li\u003e\n\u003cli\u003eStartup \u0026amp; Persistence Check (PERSIST-24)\u003c\/li\u003e\n\u003cli\u003eWi-Fi \u0026amp; Home Network Check (WIFI-LAN-02)\u003c\/li\u003e\n\u003cli\u003eRouter \u0026amp; Wi-Fi Settings Checklist (ROUTER-22)\u003c\/li\u003e\n\u003cli\u003eEmail Spoofing \u0026amp; BEC Check (BEC-08)\u003c\/li\u003e\n\u003cli\u003eBreach \u0026amp; Identity Exposure Check (BREACH-10)\u003c\/li\u003e\n\u003cli\u003eInsider Risk Self-Assessment (INSIDER-21)\u003c\/li\u003e\n\u003cli\u003eIndustry Readiness Questionnaire (READINESS-91)\u003c\/li\u003e\n\u003cli\u003eInternet Exposure Scan (EXPOSURE-06)\u003c\/li\u003e\n\u003cli\u003eWebsite \u0026amp; Storefront Checkup (STOREFRONT-07)\u003c\/li\u003e\n\u003cli\u003eCertificate \u0026amp; Encryption Check (TLS-09)\u003c\/li\u003e\n\u003cli\u003eDomain \u0026amp; DNS Security Check (DNS-63)\u003c\/li\u003e\n\u003cli\u003eMedical \u0026amp; Operational Device Scan (DEVICES-77)\u003c\/li\u003e\n\u003cli\u003eSensitive Data at Rest Check (SENSDATA-78)\u003c\/li\u003e\n\u003cli\u003eWorkstation Policy \u0026amp; Logging Check (POLICY-79)\u003c\/li\u003e\n\u003cli\u003eCloud Storage Exposure Check (BUCKET-28)\u003c\/li\u003e\n\u003cli\u003eBusiness Impersonation \u0026amp; Typosquat Sweep (IMPERSON-19)\u003c\/li\u003e\n\u003cli\u003eAI Usage \u0026amp; Shadow-AI Exposure Review (AIUSE-70)\u003c\/li\u003e\n\u003cli\u003eDigital Asset Register \u0026amp; Ownership Check (REGISTER-74)\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eBefore it runs: one question you can say no to\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMay the Sensitive Data at Rest Check count files in this computer's profile folders whose contents match regulated-data patterns (such as Social Security number shapes beside a name)? It reports counts only: never a match, a file name or a path. Optional. Say no and the report records that this check was skipped at your request.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003ePrice\u003c\/h3\u003e\n\u003cp\u003e\u003cstrong\u003e$649 a year\u003c\/strong\u003e, four runs, one every 90 days, with a trend line on every check from the second run. One run on its own is \u003cstrong\u003e$499\u003c\/strong\u003e: the School \u0026amp; Campus Hardening Bundle (IND-EDU-88).\u003c\/p\u003e\n\u003ch3\u003eWhat it never does\u003c\/h3\u003e\n\u003cp\u003eIt never changes a setting, installs anything, tries a password or signs in to an account. Where a check reads inside files it reports counts only — never a value, a file name or a path. Nothing is exploited and no credential is guessed. Your own answers are recorded as yours and never upgraded into something the scan observed.\u003c\/p\u003e","brand":"ThreatVector","offers":[{"title":"Default Title","offer_id":53138393170232,"sku":"IND-EDU-Q-88","price":649.0,"currency_code":"USD","in_stock":false}]},{"product_id":"non-profit-charity-hardening-bundle","title":"Quarterly Non-Profit \u0026 Charity Hardening","description":"\u003cp\u003e\u003cem\u003eEvery 90 days, with a trend line on every check.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch3\u003eWhat it is\u003c\/h3\u003e\n\u003cp\u003eRuns twenty-four checks on this computer, the network it is on and the domains you declare, asks your charity's questions once, and maps everything to NIST CSF 2.0 in one report. Nothing is changed.\u003c\/p\u003e\n\u003cp\u003eA charity is measured by its donors, its funders and its state, and one forged invoice or a donor list that left with a volunteer costs the trust that gifts depend on. This bundle gathers what one office can show: its computers, the donor and beneficiary data at rest and the doors it could leave through, your domain and look-alike domains, and your own answers.\u003c\/p\u003e\n\u003cp\u003eThis is the quarterly form of the Non-Profit \u0026amp; Charity Hardening Bundle (IND-NONPROFIT-90): the same 24 checks, run four times a year, each report showing what changed since the last.\u003c\/p\u003e\n\u003ch3\u003eThe framework\u003c\/h3\u003e\n\u003cp\u003eMapped to NIST CSF 2.0 — with CISA's Performance Goals and PCI DSS by reference. The report maps what the scan observed on this computer, this network and the domains you declare to that framework's expectations and shows where each finding sits. It is a map of findings to the framework, not a ruling on whether you meet it, and it is not a risk analysis; your industry's expectations stand beside the findings, never in place of them.\u003c\/p\u003e\n\u003ch3\u003eWho it is for\u003c\/h3\u003e\n\u003cp\u003eA charity or non-profit with a small staff, volunteers, a donor CRM and grant data, with its own computers and domain. A national charity or a federation of affiliates is measured across every chapter and system and is the human-delivered engagement's customer; this bundle is one organisation's first look.\u003c\/p\u003e\n\u003cp\u003eA national charity or a federation of affiliates is measured across every chapter, every shared system and every funder's requirement, with a program that covers the whole. That is the work of the human-delivered ThreatVector engagement. This report is still correct about the computer it ran on and is a useful first look for the executive director or IT volunteer who ran it.\u003c\/p\u003e\n\u003ch3\u003eWhat runs (24 checks)\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eWindows Security Health Check (ENDPOINT-01)\u003c\/li\u003e\n\u003cli\u003eRansomware Readiness Check (RANSOM-READY-03)\u003c\/li\u003e\n\u003cli\u003eAccount \u0026amp; Access Review (INSIDER-ACCESS-05)\u003c\/li\u003e\n\u003cli\u003eCredential Hygiene Check (PW-HYGIENE-11)\u003c\/li\u003e\n\u003cli\u003eOut-of-Date Software Scan (EOL-16)\u003c\/li\u003e\n\u003cli\u003eStartup \u0026amp; Persistence Check (PERSIST-24)\u003c\/li\u003e\n\u003cli\u003eWi-Fi \u0026amp; Home Network Check (WIFI-LAN-02)\u003c\/li\u003e\n\u003cli\u003eRouter \u0026amp; Wi-Fi Settings Checklist (ROUTER-22)\u003c\/li\u003e\n\u003cli\u003eEmail Spoofing \u0026amp; BEC Check (BEC-08)\u003c\/li\u003e\n\u003cli\u003eBreach \u0026amp; Identity Exposure Check (BREACH-10)\u003c\/li\u003e\n\u003cli\u003eInsider Risk Self-Assessment (INSIDER-21)\u003c\/li\u003e\n\u003cli\u003eIndustry Readiness Questionnaire (READINESS-91)\u003c\/li\u003e\n\u003cli\u003eInternet Exposure Scan (EXPOSURE-06)\u003c\/li\u003e\n\u003cli\u003eWebsite \u0026amp; Storefront Checkup (STOREFRONT-07)\u003c\/li\u003e\n\u003cli\u003eCertificate \u0026amp; Encryption Check (TLS-09)\u003c\/li\u003e\n\u003cli\u003eDomain \u0026amp; DNS Security Check (DNS-63)\u003c\/li\u003e\n\u003cli\u003eBusiness Impersonation \u0026amp; Typosquat Sweep (IMPERSON-19)\u003c\/li\u003e\n\u003cli\u003eDigital Footprint Report (FOOTPRINT-12)\u003c\/li\u003e\n\u003cli\u003eCloud Storage Exposure Check (BUCKET-28)\u003c\/li\u003e\n\u003cli\u003eOrganizational Breach \u0026amp; Exposure History (ORGHIST-75)\u003c\/li\u003e\n\u003cli\u003eAI Usage \u0026amp; Shadow-AI Exposure Review (AIUSE-70)\u003c\/li\u003e\n\u003cli\u003eDigital Asset Register \u0026amp; Ownership Check (REGISTER-74)\u003c\/li\u003e\n\u003cli\u003eRemovable Media \u0026amp; Cloud Sync Check (DATAEXIT-76)\u003c\/li\u003e\n\u003cli\u003eSensitive Data at Rest Check (SENSDATA-78)\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eBefore it runs: two questions you can say no to\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMay the Removable Media \u0026amp; Cloud Sync Check also read which cloud-sync clients are installed on this computer and which of your folders they hold? It never signs in to any account and never reads a file. Optional. Say no and the report records that this check was skipped at your request.\u003c\/li\u003e\n\u003cli\u003eMay the Sensitive Data at Rest Check count files in this computer's profile folders whose contents match regulated-data patterns (such as Social Security, card or account number shapes)? It reports counts only: never a match, a file name or a path. Optional. Say no and the report records that this check was skipped at your request.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003ePrice\u003c\/h3\u003e\n\u003cp\u003e\u003cstrong\u003e$499 a year\u003c\/strong\u003e, four runs, one every 90 days, with a trend line on every check from the second run. One run on its own is \u003cstrong\u003e$399\u003c\/strong\u003e: the Non-Profit \u0026amp; Charity Hardening Bundle (IND-NONPROFIT-90).\u003c\/p\u003e\n\u003ch3\u003eWhat it never does\u003c\/h3\u003e\n\u003cp\u003eIt never changes a setting, installs anything, tries a password or signs in to an account. Where a check reads inside files it reports counts only — never a value, a file name or a path. Nothing is exploited and no credential is guessed. Your own answers are recorded as yours and never upgraded into something the scan observed.\u003c\/p\u003e","brand":"ThreatVector","offers":[{"title":"Default Title","offer_id":53138406703416,"sku":"IND-NONPROFIT-Q-90","price":499.0,"currency_code":"USD","in_stock":false}]}],"url":"https:\/\/cybermafia.store\/collections\/quarterly-checkups.oembed","provider":"ThreatVector","version":"1.0","type":"link"}