About RootGuard
We establish whether the controls an organization believes are in place are actually operating, and produce the evidence to demonstrate it. We also publish the documentation to build those controls, for organizations that would rather do it themselves.
Organizations of this size are rarely careless about security. They buy the tools, they engage a provider, and somebody is nominally responsible. What they cannot do is answer the question that eventually arrives: prove it. It comes as a customer questionnaire, an insurance renewal, a board asking what protects the business, or a regulator after something has gone wrong.
Somebody says the control is in place. Usually they are right, and usually nobody has checked. A setting exists, which establishes a point in time rather than that the control operates across the whole population, over a period, for everyone. Most gaps live in that space. Not in controls nobody thought of, but in controls everybody assumed were working.
Set out in full, because the second list is the one that saves everybody time.
The split is deliberate. We assess and we verify; the work in between is done by the people who run your systems, because they are the ones who will still be running them afterwards.
Against evidence, not assertion. Complete populations where the scale allows.
Ours
Tailored to your organization rather than adopted whole.
Ours
We say precisely what has to change. Your team or your provider acts.
Yours
The people who operate a control are shown how. You procure it.
Yours
We check each action against the criterion agreed at assessment.
Ours
Verification is the stage most engagements omit. A message saying the work is done is not evidence that it was, and the criterion it is checked against was agreed before the work started.
An assessment establishes where you stand on a given day, and security is not a condition you reach and hold, so a single engagement has a short half-life however good it was. What matters is the arrangement that comes after it.
So the first engagement is deliberately finite. Fixed scope, fixed fee, fixed end date, and no obligation of any kind afterwards. We would rather you chose to continue than found you could not leave, and an engagement designed to make itself necessary is not an engagement worth buying.
Your team or your provider configures. We determine what the evidence shows and record it, which is why the conclusion survives being challenged.
The person who assessed your controls is accountable for the findings and reachable a year later, not a name on a proposal.
We ask for the export, the report and the record, and examine complete populations where the scale allows. Nine of fifty-eight accounts proves very little.
Agreed before the work started and written so a third party can check it. A message saying the work is done is not evidence that it was.
Editable, no platform, no license, no subscription needed to keep using something you already have.
If our view after the free review is that you do not need a paid engagement this quarter, that is what you will hear.
| Trading name | RootGuard Security |
| Company number | [number] |
| Registered office | [registered address] |
| Contact | contact@rootguardsecurity.com |
| Security contact | security.txt |
Take the free readiness assessment, send us the result, and we will spend forty-five minutes going through it at no charge. You will know within the hour whether our reasoning is worth paying for.
Also useful: Where we are the wrong answer · The whole portfolio · Free downloads