Security, with receipts
We find the gaps attackers would use, close them, and hand you a Receipt for every fix: what we changed, how we tested it, and when we'll check again.
For founders, IT leads and operations teams who are asked to prove their security to someone else.
Receipts can be mapped to
The problem
Security is usually sold on trust: long reports, confident dashboards and assurances that are hard to check. Promises don't answer an auditor, an insurer or a customer's security questionnaire. Evidence does.
31%
of breaches now begin with an exploited vulnerability, the most common way in.
Verizon Data Breach Investigations Report 2026
48%
of breaches involve a third party, up 60% in a single year.
Verizon Data Breach Investigations Report 2026
$4.99M
average cost of a breach worldwide, a record high, with 247 days on average to identify and contain it.
IBM Cost of a Data Breach Report 2026
The MS Cyber Receipt
Every control we set up, every pilot we run and every AI agent we deploy ends in a Receipt. Every screen below is an example.
Every Receipt has its own number and issue date, so it can be referenced and filed.
One control, in plain words: what we found and exactly what we changed.
How we proved the change works, not just that it was made.
Configuration exports, test results, screenshots: the record behind the claim.
Controls drift. Every Receipt has a re-check date and is re-issued when checked.
Status, re-check date and the named engineer who signed it: the part you keep and forward.
| Date | Receipt | Control | Status |
|---|---|---|---|
| 02 Oct 2026 | No. 0139 | Backup restore test | Verified |
| 09 Oct 2026 | No. 0140 | Laptop disk encryption, 42 of 42 | Verified |
| 16 Oct 2026 | No. 0143 | Admin MFA, 11 of 12 | Watching |
| 23 Oct 2026 | No. 0141 | Old campaign subdomain | Exposed |
| 16 Jan 2027 | No. 0142 | DMARC p=reject, re-check due | Verified |
Every Receipt carries a re-check date. Before it, we test the control again and re-issue the Receipt, or tell you what drifted.
Every action an agent takes leaves a receipt.
Who asked, what it did, which data it touched and who approved it. You can search the log, audit it and stop the agent at any time.
Why receipts
Your board asks
“Are we actually protected, or just paying for tools?”
A one-page summary of every Receipt: what is verified, what is being watched, what is still exposed, and the plan for each.
Your insurer asks
“Can you show multi-factor sign-in is enforced on every admin account?”
The Receipt for admin sign-in, with the policy export and the test that proves a sign-in without MFA is blocked.
Your auditor asks
“When was this control last tested, and by whom?”
Every Receipt is dated and signed by the engineer who did the test, with a re-check date, so the answer is on the page.
Your enterprise customer asks
“Please send evidence for each of these security questions.”
A bundle of Receipts mapped to their questionnaire, so each answer points to a tested control.
Your own team asks
“What changed last month, and why?”
Every change Receipt from the month in one list: what changed, why, who approved it and how it was tested.
What we do
01 · Technical controls
Identity, email, domain, endpoint and cloud controls that protect your brand and digital assets, each one tested and receipted.
You hold: controls set to a clear standard, each tested, each with a Receipt and a re-check date.
02 · Security innovation
Pilot new defences on a small, safe slice of your systems, with before-and-after receipts, before you commit.
You hold: measured results and a go or no-go recommendation.
03 · Tech transformation
Move tools, data and workflows forward, including AI agents in production, with a receipt for every change.
You hold: a workflow that runs, controls built in, and runbooks your team can own.
AI agents
Agents can read, write and act inside your systems. That is the point, and the risk. We deploy them with scoped access, a short list of approved tools and a person who must approve anything that can't be undone.
92%
of organisations with an AI-related security incident lacked proper AI access controls.
IBM Cost of a Data Breach Report 2026
45%
of employees now use AI regularly on work devices, authorised or not, up from 15%.
Verizon Data Breach Investigations Report 2026
How it works
The same four steps for one control or a whole organisation. The last two are what most providers skip.
We learn how your business runs and look for the gaps an attacker would use first.
You holdA ranked list of findings, in plain language.
We close the gaps in priority order, with your team, without stopping the business.
You holdConfigured controls and the runbooks to own them.
We test every fix and write it up as a Receipt with the evidence attached.
You holdReceipts you can forward to anyone who asks.
Controls drift. We re-test before each Receipt expires and re-issue it.
You holdReceipts that stay current, not a report that ages.
2-minute self-check
Six controls auditors and insurers ask about. Answer honestly: it runs in your browser and stores nothing.
0 of 6 answered
You could prove 0 of 6.
Answer all six to see where you stand.
Get your first ReceiptsWays to start
Every engagement is scoped to your organisation. We agree the outcome, the timeline and the price before work begins.
The usual first step
Your first Receipts: where you stand across identity, email, devices, cloud and people, and what to fix first.
Book a baselineOne area, done properly
A focused push on one area, such as email and domain, until every control is tested and receipted.
Plan a sprintBefore an agent goes live
Scoped access, approvals and action receipts designed and tested before an agent touches real data.
Check readinessReceipts that stay current
We re-check every Receipt before it expires and report on what changed.
Talk it throughAccountability
Security work asks for a lot of trust. We'd rather earn it in writing. This is how every engagement is set up, before anyone touches your systems.
Scope, access, timeline and price are signed off before work starts, under a confidentiality agreement.
Nothing changes in your live systems without a named approver on your side, and every change gets a receipt.
Every account and permission we use is listed in advance, removed at the end, and you're told where your data is processed.
Each Receipt is signed by the engineer who did the work. Questions go to that person, not a ticket queue.
Evidence travels with every Receipt, so your auditor, insurer or customer can check the work without taking our word for it.
Receipts, evidence and runbooks belong to you, in standard formats. If you move on, nothing stays locked with us.
Questions
A number and date, the control, what we found, what we changed, how we tested it and the evidence, plus a stub with the status, the re-check date and the name of the engineer who signed it.
Every Receipt carries a re-check date. Before it, we test the control again and re-issue the Receipt, or tell you what drifted and fix it.
Only what the work needs, agreed in writing before we start. Most baselines need read-only access to your identity, email and cloud admin consoles.
We tell you before work begins, list every service that touches your data, and keep what we collect to the minimum.
Every engagement is scoped to your organisation. We agree the outcome, the timeline and the price before work begins.
The Receipt says so. It is marked Exposed, with the fix, its priority and an owner, and it moves to the top of the list.
No. We work with your team and the tools you already have, and leave runbooks so your people can own every control.
Tell us what you need to prove, and to whom. We'll show you where to start.