A structured, Microsoft-native security assessment for South African SMEs. We map exactly how you'd be breached today, score every domain, and hand you a prioritised fix list in plain English. One fixed fee. No fear-selling.
Attacks are automated. Nobody picks you — a script finds an open door and walks in. The gaps below are the ones we find over and over in businesses your size.
One phished or reused password and the mailbox is theirs. Without MFA, that's the whole breach.
A compromised mailbox silently forwards mail and swaps banking details on a real invoice. Money gone, no malware needed.
Ex-staff and forgotten admin logins nobody switched off — standing doors into your data.
Personal laptops with company data, no encryption, no way to wipe them when lost or stolen.
We assess against a Microsoft-native baseline and your official Secure Score — measured, not guessed — mapped to POPIA.
MFA coverage, conditional access, legacy auth, admin sprawl.
SPF, DKIM, DMARC, forwarding rules, phishing exposure.
Encryption, patching, management, remote-wipe capability.
Where data lives, backup separation, tested recovery.
What you pay for vs use — often self-funds the fixes.
Exposed services, ageing website software, public footprint.
What happens in the first hour of a breach — if anything.
Information officer, data mapping, breach obligations.
No 90-page PDF nobody reads. One clear scorecard, findings ranked by real-world risk, and a fix list split into "free / configuration" and "needs investment" — so you can close the cheap gaps immediately, whether or not you hire us.
Every red item comes with what it is, why it matters in rands, and exactly how it gets fixed.
All fixed-fee, one-off, remote. The fee is credited in full if you move to a Managed IT plan within 60 days.
We confirm size, stack and access. You create us a dedicated admin account — we never take your password.
We pull real data from your Microsoft environment. No agents on staff machines, no downtime, no one interrupted.
Every domain rated, findings ranked by rand-risk, fixes split into free vs investment.
We talk you through it live and fix the quickest wins on the call. What you do next is your call.
Cosmic Mango runs three assessment practices. Take more than one and the price drops — same team, one report cycle, one invoice.
Book a scoping call. Fixed fee, plain-English report, yours to keep. Worst case: proof you're already solid.
Book my security assessment