SPEC · security-posture-sprint
Security Posture Sprint
A customer questionnaire, cyber insurer, or security scorecard just graded your company, and the grade was not great. Most of what they measure is fixable in a sprint.
price $2,000 to $3,500timeline 1 to 2 weeks
Scorecards and questionnaires mostly measure externally visible hygiene: DNS records, email auth, TLS, headers, open ports. That is genuinely worth fixing and genuinely fast to fix. I took a production domain to a 99 on SecurityScorecard; this sprint applies the same checklist to yours, with before and after evidence you can send straight back to whoever asked.
What's included
- External posture scan: DNS, email auth records, TLS, security headers, exposed services
- Fixes applied for everything low-risk and in reach: records, headers, TLS config
- Prioritized findings for anything needing deeper work, with effort estimates
- Before and after scorecard evidence
What's not included
Fixed prices only work with honest boundaries. Here is where this project ends:
- Penetration testing (this is hygiene and hardening, not exploitation)
- Compliance program management (SOC 2, HIPAA, etc.)
- Internal network or endpoint security
Deliverables
- Findings report with severity and effort ratings
- Applied-fixes log
- Before/after scan evidence for your questionnaire or insurer
Timeline
1 to 2 weeks.
What I need from you
- DNS access and access to whatever fronts your site (Cloudflare, load balancer, web server)
- The questionnaire or scorecard report that started this, if there is one