Cybersecurity for early-stage founders. Without the theater.

A self-assessment, a prioritized roadmap, and the names of the specific tools to use. No compliance gauntlet. No consultant pitch. Free, your data stays yours, take it in ten minutes.

Start the assessment

About 10 minutes. No card required. We don't ask for one because we don't take one.

What you'll get.

A small set of questions that respect your time.

Seven about your company. Eighteen about your practices, if you pick the short track. Up to forty if you want the full picture. Every question has a "why we ask" you can expand. Nothing is jargon you can't decode.

A roadmap, in plain language, sorted by what to do this week.

Each recommendation names specific tools, gives an honest time and cost estimate, and points to the vendor's own docs for the click paths we don't pretend to maintain. Mark items done as you go. Come back next quarter; we'll show you what changed.

Grounded in work other people have already done thinking about this.

CIS Critical Security Controls, the OWASP Top 10 for LLMs, Rob Fuller's 2026 Day Zero CISO Brief, and Chris Castaldo's Start-Up Secure. Every recommendation cites where it came from.

What it actually looks like.

Three recommendations as they'd render in your roadmap. Nothing is held back; the assessment is free and so is everything in it.

This week Effort: hours Cost: low

Buy hardware keys for every admin, today

+ Why it matters

Order two FIDO2/WebAuthn hardware keys per admin. One primary, one backup kept somewhere safe. While the keys ship, enroll device passkeys on the same accounts so you're not waiting to start. Enroll the keys on your identity provider first, then source control, then your cloud's root account, then any other crown-jewel SaaS. Disable SMS and push as fallback factors once keys are working. Leaving them on means an attacker can downgrade to the weakest one. YubiKey 5 NFC is the common choice (around $50 each), but any FIDO2-certified key works.

Sources: CIS 6.5; Fuller §PROTECT Last reviewed: 2026-06

This week Effort: hours Cost: free

Write your AI usage policy: one paragraph is enough

+ Why it matters

Open your team handbook or Notion. Write one paragraph answering four questions: which AI tools are approved for company work (be specific; "Claude.ai with enterprise data controls on; ChatGPT Team; GitHub Copilot" is specific; "AI tools we trust" is not); what data is never to be pasted into any of them; the rule for ambiguous cases (ask before pasting); and who to ask. Pin the doc. Re-share it whenever you add an approved tool.

Sources: Fuller §GOVERN (AI usage policy) Last reviewed: 2026-06

This quarter Effort: hours Cost: free

Actually restore from backup this quarter

+ Why it matters

Schedule 45 minutes this week. Pick your customer database. Restore the most recent backup into a fresh, isolated database. Most managed providers have a "restore to new instance" option. Run three checks: row count on your largest table, presence of the most recent customer record, and presence of data created in the hour before the backup. Document the time the whole thing took end-to-end. That number is your real recovery time.

Sources: CIS 11.5; Fuller §RECOVER Last reviewed: 2026-06

How this is different.

We don't sell you anything else.

There's no enterprise tier we're pushing you toward. No consulting engagement we're trying to upsell. The free assessment is the whole product. If we ever charge for something, it'll be for features you actually asked for.

Your data is yours.

We don't run analytics. We don't have a third-party tracking pixel. Your assessment responses are visible only to you, and you can delete everything with one click in your account. We're not saying that because it sounds good. We're saying it because if you can't trust us with this, you shouldn't be using the rest of it either.

The advice ages well.

Most online security advice is vendor-shaped, time-bound, or both. We name the specific tool when it's the right answer (YubiKey, Dependabot, Cloudflare) and link to the vendor's own docs for the click paths. When a recommendation is updated, you see the date.

Ready?

Ten minutes. No card. No drip campaign afterward. Start when you have a coffee in front of you.

Start the assessment

Or read more first.