Minutes To Scope
One call is enough to know what you run, what worries you, and what we’ll leave alone.
The prophet was right and no one acted. We built a company around the second half of that sentence. You hear the warning, and you get the fix list to go with it.
Cassandra was cursed to see disaster coming and be ignored. Plenty of security shops live that curse every week: a 90-page scanner dump lands in an inbox, nobody can tell which line matters, and six months later the same door is still open.
Cassandra Security was started to break that loop for small and mid-size companies, the ones with fifteen desks, one person who “does the computers,” and no budget for a security team. We work out of an office on Light Horse Court in Marlton, NJ, and we test the way a patient stranger would: from the outside first, then as far in as your scope letter allows.
You don’t get a pass or a fail. You get a short, ranked list: what we reached, how we got there, and the smallest fix that shuts that door. Then we come back and check your work.
If your team can’t act on it by Friday, we wrote it wrong.How we edit every report
No signed scope letter, no testing. It names the systems, the dates, the techniques, and what’s off-limits, and it’s the first document you receive.
A critical finding gets a call to your named contact within 48 hours. You should never learn about an open door from an inbox you check on Monday.
Every finding ships with the cheapest change that closes it. We’ll tell you when a setting beats a new product, even when that makes the report shorter.
The invoice follows the report. You pay once you’re holding the prioritized list, by ACH, check, or card, and the price on page one of the scope letter is the price on the invoice.
Ninety pages of scanner output, severity scores without context, and a PDF nobody opens twice.
A short ranked list, each item with proof, a plain-English “why it matters,” and the smallest fix.
A sales call about a bigger package, and silence about whether your fixes worked.
A live debrief, then a retest of what you fixed within 30 days, with written confirmation of what’s closed.
Security work shouldn’t feel like a black box. Here’s what you can count on from the first call to the retest.
One call is enough to know what you run, what worries you, and what we’ll leave alone.
A critical finding reaches your named contact by voice, then in writing.
The person who scopes your test is the person who walks you through the results.
Fix what we found and we check it, then confirm in writing what’s closed.
If your office manager can’t follow the summary page, we rewrite it.
Invoice arrives with the report in hand, not before.