Capabilities // Scope // Deliverables
We don't advise and disappear. Every engagement ends with a clear picture of your exposure, evidence for every finding, and a concrete path forward that someone is accountable for.
Five Core Services
Each engagement is fixed in scope and delivered by the same operator who assessed your environment. No handoffs to junior analysts, no findings you can't reproduce.
A network security assessment is a hands-on evaluation of your network's exposure — external footprint, internal segmentation, firewall rules, and wireless — combined with penetration testing to verify which weaknesses are actually exploitable. Sparrowhawk delivers findings ranked by real business impact, with reproduction steps and a remediation plan, typically within two to four weeks depending on environment size.
Your perimeter has gaps. Most organizations don't find out until someone else does. We map your attack surface the way an attacker would, then test whether your defenses actually hold. What you get back is a prioritized remediation plan ranked by real exploitability, not a 200-page PDF that collects dust on a shared drive.
Infrastructure security hardening is the process of closing configuration-level weaknesses across servers, endpoints, and directory services. Sparrowhawk's hardening engagements cover Active Directory privilege tiering, server and endpoint baselines, patch governance, service account hygiene, and validation that your logging and detection actually fire during an attack — verified by testing, not assumed.
Antivirus is not a security program. Your servers, endpoints, and directory services are where an intrusion becomes a breach — and where most environments are quietly misconfigured. We harden at the configuration level, with detection coverage that actually fires when something goes wrong instead of logging quietly into a void.
Proving cyber insurance compliance requires documented evidence that each control named in your policy — MFA, immutable backups, endpoint protection, and a tested incident response plan — is actually deployed and working. Sparrowhawk audits your environment line by line against your specific policy language and produces an underwriter-ready evidence package, which is what determines whether a claim is paid or denied.
Answering “yes” on the application is easy. Proving it at claim time is where policies get denied. We audit your environment against the specific control language in your policy and hand you the evidence your underwriter will accept — before you need it.
A virtual CISO provides senior security leadership on a fractional basis — owning security posture, policy governance, vendor risk decisions, and incident response readiness without a full-time executive salary. Organizations typically engage one when they have compliance or contractual obligations but no internal security owner. Sparrowhawk delivers this on a monthly retainer, reviewed quarterly as needs change.
Most small and mid-size organizations need security judgment more often than they need a full-time executive — someone who owns the posture, sets priorities, and is accountable when a decision has to be made.
Securing Microsoft 365 and Entra ID means enforcing Conditional Access and MFA across every access path, shutting down legacy authentication, auditing role assignments and app consents, governing external sharing, and verifying that departed employees retain no access. Sparrowhawk performs this as a security engagement rather than a managed service, and most tenants are found to have licensed protections that were never switched on.
You're paying for Microsoft 365. A significant portion of what you're paying for is misconfigured or switched off. We verify that former employees aren't still reaching your data from an unmanaged device three states away.
Pricing
Sparrowhawk prices every assessment as a fixed fee against a written scope, agreed before any work begins. Cost is driven by environment size — user count, number of sites, and whether operational technology is in scope — not by hourly billing. Virtual CISO and security retainer work is billed monthly and reviewed quarterly. Request a briefing for a scoped quote.
One price, agreed in writing before work starts. It does not change unless you change the scope in writing. Covers testing, reporting, the findings walkthrough, and re-testing of critical items.
A recurring monthly fee scaled to your organization's size and obligations, reviewed quarterly. Includes priority access during an active incident.
The first conversation is free and carries no obligation. If an engagement doesn't make sense for you, we say so — including pointing you elsewhere when that's the right call.
How an Engagement Runs
A Sparrowhawk engagement runs in four phases: a no-cost technical briefing, a written scope and fixed-price agreement with defined rules of engagement, hands-on assessment with critical findings escalated immediately by phone, and a final report with ranked findings, evidence, an executive summary, and re-testing of critical items.
A technical conversation about your environment, your obligations, and what's actually keeping you up at night. No cost, no pitch.
Written scope, fixed price, defined timeline, and rules of engagement signed before anyone touches a system.
Hands-on testing and review. Critical findings are escalated immediately — you don't wait for the report.
Ranked findings with evidence, an executive summary, and a walkthrough. Re-testing of critical items included.
Get Started
We provide technical security briefings for business owners, operations leaders, and IT teams who want a straight answer about where they stand. No sales pitch.
Request a Security Briefinginfo@sparrowhawktech.com · sparrowhawktech.com