From $3,500
Delete before you harden. Most of what you are securing should not exist.
This is for the owner whose operation has grown by addition. Every year brought a new dashboard, a new admin panel, a new automation platform, a new place where someone can press a button that moves money, sends mail or changes a record. Each one has credentials. Each one has a shared login. Each one shows up on the security bill as a thing to protect. A disconnection audit asks what is not wired up. This is the inverse: it asks what is wired up twice, proves which copy is dead weight, and removes it before you spend a dollar hardening it. Fewer surfaces means fewer credentials, fewer approvals, fewer places to be wrong.
What you get
The deliverables, stated plainly.
Function uniqueness
Every control surface and the function it performs, with duplicates marked. Two places that can issue a refund is one too many.
Approval-surface count
Every surface where a human can approve a consequential action, and whether that approval is real or a rubber stamp.
Credential blast radius
What each surface's credentials can reach if they leak, so you see which redundant surface is also your largest exposure.
Cost-per-surface
What each surface costs to run, license, secure and staff.
Kill-test
Each candidate is disabled under supervision and the result recorded. A surface nothing misses is deleted. A surface something depends on is kept and documented.
A keep/delete register
A one-line reason per decision, and an optional quarterly re-audit.
How it runs
Week one is the map. We get system access within 5 days of signing and inventory every surface that can take an action, not just the ones IT knows about. Week two is scoring: uniqueness, approval count, blast radius and cost, delivered as one table you can read in ten minutes. Week three is the kill-tests, run one at a time with a rollback ready and the owner informed. Week four is the deletions, the documentation of what was kept and why, and the handoff. You see every draft within 3 days of asking, and we hold a weekly check-in throughout.
What it costs
Payment is 65% at signing and 35% on acceptance. The founder confirms the number on the call. Where the audit includes building an automation workflow to replace deleted surfaces, that workflow carries our guarantee: one workflow automation that saves your team at least 10 hours per week, or 100% of the build fee back.
Why now
The doctrine comes from our own operation. This autumn we ran the five checks on ourselves. Two redundant control surfaces were deleted; a third was kept because it was load-bearing. The keep/delete decision is one decision, made with the same evidence: what does this surface uniquely do, who approves through it, what can its credentials reach, what does it cost, what happens when we turn it off. The two we deleted had been on the hardening list. They are no longer on any list. The market makes this urgent rather than tidy: cyber-insurance questionnaires now ask for an inventory of agents and the controls governing each one. Every surface you delete is a line you do not have to inventory, defend or explain.
Questions people ask
Is it not safer to keep a backup way to do things?
A backup nobody tests is not a backup; it is an unmonitored door. If the kill-test shows a surface is load-bearing, we keep it and document it. If nothing missed it, the safest thing is for it to be gone.
What if we delete something and need it later?
Every deletion follows a supervised kill-test and a recorded rollback path. We delete the surface, not the knowledge of how it worked.
How is this different from an IT security assessment?
A security assessment tells you how to protect what you have. This tells you what to stop having. It runs first, so the assessment that follows covers less ground and costs less.
How many surfaces does a small firm have?
More than a dozen is typical once admin panels, automation platforms, vendor dashboards and shared logins are counted, and a share of them duplicate a function another one already performs.
Book 15 minutes
The founder confirms the number on the call. Fifteen minutes, no deck, no pitch — we talk about your situation and tell you if there is nothing to build.