Ironside Group
Cybersecurity
Assessment
Ironside Group operates with strong detection capabilities through the M3 Platinum security stack, but lacks foundational governance policies, documented procedures, and has aging endpoint hardware that introduces significant risk.
Security Function Breakdown
Active Security Protections
Immediate Action Required
This server has been running without security updates for over six years. Think of it as an unlocked door that leads to your entire network. Attackers know exactly how to exploit this software because Microsoft stopped fixing its vulnerabilities in 2020. If CANNON is compromised, it could give an attacker access to every system in your environment.
Active Threats & Recovery Gaps
Your employees' passwords are already on the dark web. Attackers don't need to hack you — they can just log in. These aren't theoretical risks. These are active credentials circulating in criminal marketplaces right now.
If ransomware encrypts your systems tonight, there is no tested way to get your data back. No documented recovery plan, no verified backup procedures. Every hour of downtime costs real money — payroll still runs, revenue stops, and customers can't be served.
Governance & Policy 1 of 4
If we do nothing: No documented rules for passwords, device use, or data handling. Insurance claims ask "Where are your policies?" — today the answer is "We don't have any."
If we do nothing: First formal security review — no risk register tracking which threats matter most. Security spending decisions made without knowing which risks are highest. Insurance apps increasingly require this.
If we do nothing: IT changes happen without documentation or approval. No audit trail means if a change causes a breach or outage, you can't trace what happened. Fails compliance and insurance audits.
If we do nothing: You share data with dozens of third-party vendors. If one is breached, your data goes with it. No formal security assessment of vendor posture — no inventory of who has access to what.
Testing & Risk Assessment 2 of 4
If we do nothing: Network never independently tested. Strong defenses exist but no one has verified they actually stop a real attacker. Like having a security system and never testing the alarm.
If we do nothing: 25,000+ new vulnerabilities published every year. Without scanning, you won't know which affect your systems until an attacker finds them first.
If we do nothing: Insurance policy likely has requirements not met today. If you file a claim and the insurer finds non-compliance, they could deny the claim entirely.
If we do nothing: Not all data is equal — SSNs are more sensitive than marketing materials. Without classification, everything gets the same minimal protection. In a breach, you need to know immediately what was exposed.
Infrastructure & Endpoints 3 of 4
If we do nothing: Microsoft stopped security updates for Windows 10 in Oct 2025. These 19 machines accumulate unpatched vulnerabilities monthly. Attackers target end-of-life software specifically.
If we do nothing: Lost or stolen laptop data is only safe if encrypted. Can't confirm encryption is active across the fleet. Unencrypted laptop = every file accessible to whoever has it.
If we do nothing: M365 has hundreds of security settings — most off by default. Secure Score unknown. Misconfigured M365 is the #1 entry point for business email compromise ($125K avg per incident).
If we do nothing: Company email/data on personal phones with no controls. Lost phone = no remote wipe. When someone leaves, their device still has company data cached.
Business Continuity & Response 4 of 4
If we do nothing: If your office flooded, had a fire, or suffered ransomware tomorrow — does everyone know what to do? Who calls who? Where do people work? Every hour of unplanned downtime costs real money — payroll still runs, revenue stops, customers aren't served.
If we do nothing: When — not if — a security incident occurs, there's no playbook. Who gets called first? What's the immediate action? Without a plan, the first hour is spent figuring out roles instead of responding. That delay is when damage compounds.
Endpoint Lifecycle Assessment
| Device | Assigned To | Model | Purchased | Age | Status |
|---|---|---|---|---|---|
| ISG-LT-021 | Anna MacMaster | Lenovo 20L5004HUS | 2019-02-06 | 7.1 yr | Replace |
| ISG-LT-022 | Bob O'Donnell | Lenovo 20QNCTO1WW | 2020-09-08 | 5.5 yr | Replace |
| ISG-LT-018 | Former employee | Lenovo 20SUS34900 | 2020-11-25 | 5.3 yr | Replace |
| ISG-LT-033 | Rio Jiang | Lenovo 20SUS34900 | 2020-11-25 | 5.3 yr | Replace |
| DESKTOP-IEM5OVV | Former employee | Lenovo 20SUS34900 | 2021-01-07 | 5.1 yr | Replace |
| ISG-LT-012 | Lucinda Linde | Lenovo 20SUS34900 | 2021-01-25 | 5.1 yr | Replace |
| PF2515YK | Glenn Lightfoot | Lenovo 20SUS34900 | 2021-02-19 | 5.0 yr | Replace |
| ISG-LT-020 | Dave LeBlanc | Lenovo 20SUS34900 | 2021-02-26 | 5.0 yr | Replace |
| DESKTOP-G2NTJK5 | Local admin only | Lenovo 20SUS34900 | 2021-04-02 | 4.9 yr | Replace |
| ISG-LT-003 | Local account only | Lenovo 20SUS34900 | 2021-04-09 | 4.9 yr | Replace |
| ISG-LT-045 | Dmytro Kreiza | Lenovo 20SUS34900 | 2021-05-14 | 4.8 yr | Replace |
| ISG-LT-037 | Tim Kreytak | Unknown | Unknown | ? yr | Assess |
90-Day Security Improvement Plan
Items not addressed
= accepted risk.
Every finding in this assessment represents a gap that threat actors actively exploit. M3 Networks is ready to begin remediation immediately upon approval.
Estimated Remediation Costs
These are one-time investments to close the gaps found in this assessment. Each addresses a specific business risk — not just a technical checkbox. Your team decides which to prioritize based on risk tolerance and budget.