Diagnostic
Detection & Recovery Evidence Pack
Know what your business can actually detect, restore, and recover before an incident tests it for you.
"If someone got into our systems tonight, I could not tell you whether we would spot it, what we would get back, or how long it would take."
Fixed fee
$4,4505.0out of 5
Top Rated on Upwork · 100% Job Success · on every client-rated engagement, scored by Upwork. Delivered work →
What moves the number: tenants, sign-in, how many apps sign in through Microsoft 365, mail, Azure and endpoints. Headcount is only one of them. The scope-fit check tells you where you land →
What you walk away with
What you keep when this is done
You keep a written record of what is broken, what it is costing you, and what it costs to fix, in a form your leadership can act on. It also sets the fixed price of the fix, so nothing after this is open ended.
- A coverage map of what your security tools are actually watching, and which parts of the business would raise no alert at all.
- A restore history, system by system: what has come back before, how long it took, and where nothing proves it ever has. A controlled test restore is included only when the statement of work says so.
- A map of how far an attack would spread once it is inside: which logins it takes over, and which servers and systems those logins open up.
- A record of how security alerts are handled today, and which ones stop before they reach a person. This is an assessment of that gap, not a monitoring service.
- The gaps to close first, ranked by how much damage each one would cause.
The restore proof page of the pack: system by system, what the backup covers, whether a restore has been proven, and the recovery time measured from your own records.
How the diagnostic works
01Read-only inspection
Your live environment is inspected directly, read-only. Nothing changes and nothing breaks.
02Findings, scored and priced
You see what is actually risky, what it is costing you, and a fixed quote to fix what matters. Ranked in plain language.
03Your plan, either way
The remediation plan is yours to keep. Take the fix at the quoted price, or hand the plan to your own team or another vendor.
This is for you if
- You have a real decision or risk on the line: an audit, a renewal, a migration, a board question, or an AI rollout.
- You want findings at the sample report's level of specificity: named roles, quantified waste, tested assumptions.
- You want the price fixed in writing before the work starts.
It is not for you if
- You need a quick checkbox scan rather than findings you plan to act on.
- You are looking for open-ended staff augmentation with no defined finish line.
After the diagnostic
Remediation is scoped from the evidence
Remediation is quoted as a fixed scope rather than open-ended hours. The diagnostic shows exactly which of these you need, and what it should cost.
Stabilize
Close the urgent gaps the evidence surfaced, on a fixed scope, before they become an incident.
Control
Stand up the controls and operating model the environment was missing, in staged, measurable releases.
Oversee
Fractional Architecture Oversight once the foundation is in place: scheduled senior review on a defined monthly cadence, offered as a follow-on. Implementation is separately scoped.
Delivery, access, and scope boundaries
Typical delivery
15 business days, elapsed. The window begins after the scope is confirmed, the kickoff is complete, required access works, and requested exports and documentation have been provided. Client, licensing, or third-party delays pause the timeline.
Access needed
Read-only access to Defender, Sentinel and backup platforms where applicable, plus system inventories, existing recovery documentation, and available restore evidence. Access is time-limited, protected with MFA, and read-only wherever the platform allows. Credentials should never be submitted through the website.
Not included
No 24/7 monitoring, live incident response, forensics, production failover, destructive testing, or emergency recovery. Any controlled sample restore must be explicitly included in the statement of work.
Every assessment includes one kickoff and one findings review; extra workshops or revision rounds are a change order. Unless the signed statement of work says otherwise, no assessment includes production changes, remediation, implementation, emergency incident response, 24/7 availability, software or licensing costs, legal attestation, or third-party vendor fees. The signed statement of work controls if it differs from this page.
Other diagnostics
See all →Microsoft Estate Risk Ledger
Find the risk, waste, and missing ownership across Microsoft 365, Azure, identity, licensing, and infrastructure.
Identity & Insurance Evidence Pack
Prove your access controls before an audit, insurance renewal, or incident forces the question.
Copilot & Shadow AI Exposure Report
See what Copilot and other AI tools can reach before you roll them out, including the AI nobody approved.
$4,450
Detection & Recovery Evidence Pack