Cybersecurity & Managed IT Prepared for Valerie, Thomas, and Forrest · after our call on September 1
Eighteen months ago Diageo asked for a number, and together we took PROOF from a forecast under 400 to 649. Now CyberVadis is asking again, and one rough Saturday just showed why the paperwork was never the point. Here's the plan: get the reassessment done, close out the incident properly, and put real protection on every machine so the next ScreenConnect never gets a foothold.
The lowest bar is Identify: knowing what's on your machines and who's on them. That's exactly the gap August exposed, and it's the one that moves the most.
The principle
"Nobody at PROOF would run a Smirnoff night at SoFi without a guest list at the door, security on the floor, a staff briefing, and a wrap report. Your forty laptops ran the last five years without any of those. That's the whole gap, and it maps one to one. Everything on this page is us bringing your own standard to your own machines." Joshua R. Easters, Managing Partner, Diversicom
What you produce
What we produce
Nobody gets past the door without a wristband. On a computer, only approved software runs. A remote-access installer with no wristband gets stopped at the rope, and we hear about it within minutes.
Eyes on the room the whole night, not a walkthrough at close. A security operations team watches every machine around the clock and can pull one off the floor at 3 AM.
Your ambassadors know the pour, the script, and who to call. Your staff will know a fake Google login when they see one, because they've already refused one in a drill.
Every event ends with numbers the client can read. Every quarter you get the same for security: what improved, what's open, and what it means for the next CyberVadis cycle.
We did our homework
First, the part that deserves saying out loud: you handled a bad Saturday about as well as a team without a security partner can. You caught it within the hour, warned 1,200 people before lunch, changed the passwords that mattered, called the bank, and took the laptop to someone. You just shouldn't have had to do any of it yourselves. Here's what we mapped from Tuesday's call and last year's work.
Company computers
About 40
Plus personal devices in the mix. Count confirmed together on the walkthrough
Email and files
Google Workspace
No physical office. Workspace is the whole environment, and we hold a super-user seat from 2025
MFA today
On, not enforced
We said so in February 2025. This year it gets enforced, with a rollout your team hears about first
Policies on file
26, from 2025
Access, PAM, passwords, incident response, and 22 more. Ready to refresh, not rewrite
Who's asking
Diageo, via CyberVadis
Reassessment opened August 27. We manage the analysts directly, like last time
The UHC emails
Genuine. Not the source
Both are real Proofpoint messages from UHC's own mail system. We'll show you how we confirmed it
The work that starts now
You told us to send the assessment over and you'd sign it. Here it is, on the same terms as last year, with one addition you also asked for: a proper investigation of what happened, in writing. Both are fixed prices. Neither requires anything ongoing.
$4,500fixed
The full questionnaire, answered and evidenced by us, the way we did it in February 2025. We refresh all 26 policies to reflect what's true today, add the incident-response record this year's assessors will expect, and re-verify every Workspace control with screenshots.
One thing we do differently this time: last year several controls were on but not enforced. This year we enforce them. Everything we saw last year says the next number is higher than 649. This time we want it to hold.
$2,500fixed
The questions you asked on Tuesday, answered with evidence rather than guesses. We pull the ScreenConnect and Windows logs still on the laptop, the Workspace audit trail for August 21 through 29, and the browser and download history.
You get three things in writing: how it got in, what was touched, and whether anyone has to be notified. If notification is owed, we say so and help you write it. If it isn't, you have the document that says why.
Sign, and we start the same day. The investigation runs first because its findings feed the reassessment. Workspace gets tightened before anything else.
Findings delivered in writing. Policies refreshed, evidence gathered. MFA enforcement announced to staff, then switched on. That's the extent of your homework.
Questionnaire submitted well ahead of the CyberVadis deadline. We handle the analysts' follow-ups until the scorecard publishes.
Choose a path below, or don't yet. Either way the reassessment is handled and the incident is closed properly, with a document you can hand to anyone who asks.
Run of show
You plan every event cue by cue. Here's the week you just lived, laid out the same way, next to how each cue goes when every company computer has our security layer on it. Nothing on the right is hypothetical. These are the tools we run for our clients today.
Between an executive's forward, a broker's reassurance, and an ordinary weekend of email, a remote-control tool ended up installed on the laptop.
No alert, no prompt anyone remembers. Legitimate software used by the wrong people is exactly what antivirus is built to ignore.
Application control means only approved software can run. An unapproved remote-access installer is blocked on the spot, and the block lands on our desk with the machine, the user, and the file named.
What you'd notice Nothing. That's the point. A short note from us that something was stopped, and who to remind.
For five days a remote session sat open on a laptop that signs into payroll and the bank. Nothing looked wrong from the chair.
Malwarebytes scanned the day before and passed it, because a signed remote-access tool is not malware. Nothing on the machine was asking whether it should be there.
Managed detection on every machine, monitored 24 hours a day by a security operations team, sees a remote-control session that has no business existing and isolates the computer while it wakes us up. Tuesday, not Saturday.
What you'd notice A call from us on Tuesday, and a laptop that's already been cleaned.
A file called mymals.exe loads through the open session and starts harvesting while the laptop sits alone.
Every address ever sent, received, or copied, personal and business, going back decades. Plus a payroll document pulled into Downloads.
Endpoint detection watches behavior, not names. A process that starts reading the mailbox and writing a contact list is stopped at the first read, the session is cut, and the account's sign-ins are revoked. The list is never built.
What you'd notice An alert on your phone from us, before the boxing class ends.
"A night to remember" goes to clients, vendors, friends, and family from the real valerie@ address.
A handful of people who should have known better typed a password into a fake Google page. Now their accounts are the next problem.
The blast never happens because the harvest never did. And on the receiving end, MFA enforced across Workspace and staff drilled on lookalike login pages means a password typed into a fake page opens nothing.
What you'd notice No "disregard that email" note. No calls from your 401k rep.
The laptop goes to Geek Squad. Passwords change, a card gets closed, the banker gets a call. And the questions nobody can answer yet.
Thirty-six things removed, a work order for a receipt. What did they see, and who has to be told? Still open a week later.
Our team pulls the logs the same day and writes it up: timeline, exposure, whether notification is owed, and what changed. One call to make, to us, and a document you can hand to anyone who asks. That includes CyberVadis.
What you'd notice A calm Monday, and a PDF.
You asked, we answered
You asked a lot in an hour, and every one deserved a real answer. Here they are, in writing. Filter by area.
The incident
No. We took both emails apart. They're genuine Proofpoint secure messages from UHC's own mail system, and the attachment is a plain form with no code in it. Something else got in that week, and the investigation finds out what.
AnsweredThe incident
Best case, a phishing-only campaign, which is what the evidence so far looks like. ScreenConnect does give hard-drive access, so we work the logs to a written determination rather than guess. That's the investigation.
In the investigationThe incident
If the facts support phishing-only, no. If they don't, we tell you plainly and help you write the notice. Either way you get the document that says why, which is what your broker and CyberVadis will want.
In the investigationThe incident
Probably not. The ScreenConnect folder still on the drive is likely logs, which is why we asked you to leave it. Windows and Workspace keep their own records that a cleanup doesn't touch.
AnsweredThe incident
Workspace has settings we can raise, and we raise them in the first 48 hours. But no spam filter would have stopped this one, and we'd rather say that than sell you a filter. The real answer lives on the computer.
AnsweredThe reassessment
Yes, and it's to your advantage. Assessors score how you detected, responded, and changed, not whether something happened. An incident you can document well is worth more than one you hope they don't notice.
In the reassessmentThe reassessment
We don't promise numbers. We can say that last year several controls were on but not enforced, and this year they get enforced. Everything we saw in 2025 says the next number is higher than 649, and with Fortify in place it holds.
Honest answerGoing forward
Yes. On either path, your staff get one number, the same number, every time something looks off. We handle it and you get a summary. Your colleague who's been doing this out of goodwill gets his evenings back.
Included on either pathGoing forward
Two things, today: change the password on every account signed into during the window (Human Interest is still open), and turn on two-factor everywhere it's offered. Everything past that is the plan below.
Do this todayThe Diversicom difference
Plenty of vendors sell security software. These are the things that, day to day, make PROOF's life genuinely easier, and they're built into how we work, not billed as extras.
Today a security question at PROOF finds whoever happens to be reachable. With us in place, everyone on your team has our support line, staffed by our helpdesk and security engineers. "Is this email real?" gets answered by a person in minutes, not by a group text.
Incident reports, quarterly risk scores, the reassessment evidence. When your broker, your insurer, or Diageo asks, you hand them a document instead of a story.
Incident response on things we should have caught is on us. Projects are quoted in writing and approved first. When we say a number, it's the number.
We wrote your policies. We've been in your Workspace admin console. We know Thomas, Forrest, and Todd. Nobody re-learns your business on the first call.
Wherever the activation is
You have no office to secure, only people and their machines, in Louisville, Los Angeles, and wherever the client needs a crowd this month. That's the environment we built last year's work in, remotely, from Tampa. Every tool on this page installs, monitors, and responds the same way whether the laptop is at a kitchen table or a festival lawn. And the 12 to 2 window you offered us works in every one of these time zones.
Proof, for PROOF
We've spent two decades supporting remote, regulated, and field-heavy teams, many of them the same size as PROOF. We're happy to put you in touch.
Donor Services Laboratory
A regulated laboratory whose leadership wanted security they could show an auditor, not just install. We run their environment day to day and handle the questionnaires and corrective-action plans their partners require.
The Fechtel Company
A construction firm where money moves by email every day. They came to us for responsive support and straight answers, and their staff know exactly who to call the moment a message looks wrong.
Lions World Vision Institute
A 20-year partnership that grew with them from 4 employees and one branch to nearly 400 across ten states, with the security and compliance work included the whole way.
Investment
You asked for a cybersecurity package you could pay for on its own. That's Path A, and it's a real plan, not a consolation prize. Path B is what we'd choose if PROOF were our company. You haven't asked for it, and we know that. We'd just be doing you a disservice not to put it next to the other one.
Path A · Fortify
The door, the floor, and the wrap report, on its own
$40/user/mo
Priced to stand alone. Your existing IT arrangement stays exactly as it is
Path B · Manage + Fortify
Path A, plus we become PROOF's IT department
$175/user/mo
$150 Manage + $25 Fortify. The security layer drops to $25 because our agents are already on the machine
Starting now
The two projects you already said yes to
$7,000one-time
$4,500 reassessment, same as your January 2025 agreement, plus $2,500 incident investigation
Your environment, by the numbers
≈ $1,600/mo
Change the path and the headcount to match reality. We settle the real count together on the walkthrough. The $1,500 credit comes off your first monthly invoices on either path.
Credit applied: $1,500 of this year's project fee comes off the first monthly invoices, per section 9.1 of your 2025 agreement.
The same questionnaire, a different kind of engagement. Every line on the right is on this page.
| What you get | 2025 | 2026, with Fortify |
|---|---|---|
| The CyberVadis questionnaire | Answered and evidenced by us | Same, plus the incident disclosed properly |
| The 26 policies | Written, several forward-looking | Refreshed and enforced |
| MFA | On, not enforced | Enforced, with a rollout plan |
| What's on the machines | Antivirus you already had | Application control, managed detection, 24/7 SOC |
| When something gets in | Geek Squad and a work order | A written incident report |
| The next client questionnaire | Back to you | Managed by us. Diageo asks, we answer |
| Next year's reassessment | $4,500 project again | Included from year two |
| "I clicked it. Now what?" | A colleague, out of goodwill | One number, every time |
Either path is month to month after the first year, and either path starts with the two projects above. The headcount is the one number we still need to confirm together.
Straight talk
Transparency up front. The pricing above is based on the assumptions below. We confirm each on the walkthrough and review any material change with you before proceeding.
Next steps
Eighteen months ago Todd sent you our way with a deadline three weeks out and a score nobody liked. We got it done, and then we got out of the way. This time the ask is bigger than a questionnaire, and we'd like to be the people who make sure it never gets this big again. Here's all it takes:
Prepared September 2026 · pricing valid for 60 days from delivery.