Who this is for
Businesses, agencies and individuals with valuable accounts.
Situations we handle
Shared logins, ex-staff who still have admin access, no two-factor authentication (2FA), unknown connected apps, no incident plan, and preparation before a launch or event.
How the work happens
- Inventory accounts, admins, recovery methods and connected apps.
- Assess each account against our hardening baseline for that platform.
- Prioritize fixes by risk.
- Implement fixes with the client. The client performs any login-gated action.
- Write a response playbook.
- Brief the staff.
What you receive
Security assessment report, prioritized improvement list, access register (a spreadsheet of accounts, owners, admins and recovery methods), incident response playbook and a 30-minute staff briefing.
What we need from you
A list of accounts, an admin who joins working sessions, and authority to change settings.
Excludes
Penetration testing of the client's own systems, device forensics and managed IT.
Your starting point
A consultation, then Security Foundation.
Build an access record your team can maintain
A business account should have a named owner, documented administrators and a recoverable route back into the account. The review records who can publish, manage advertising, grant access and change recovery settings so that permissions can be checked when staff or agencies change.
If access is already lost, begin with account recovery support. If another account is using your business identity to approach customers, review brand protection against impersonation.
What we need from you
A clear description, public account references and confirmation that you own the assets or are authorized to act. We agree an evidence checklist after assessment. Never send passwords or verification codes.
Platforms, registrars and hosts make the final decisions on recovery and removal. We cannot promise their outcomes.