§ faq
Straight answers.
The questions we get most, answered the way we’d answer them in email. Anything missing — ask, and a person replies.
Our MSP handles our IT. Why would we need this?
Your MSP patches. Most don't send you a prioritized, plain-English read of what matters, or evidence formatted for an insurance renewal. Most of our MSP-managed clients forward the Wednesday briefing straight to their provider as the week's checklist. We watch, they patch — different jobs.
Security newsletters and CISA alerts are free. Why pay?
They are, and they're good. They're also written for everyone, which means someone at your company still has to read all of it and work out what applies. That filtering is the product: we read everything, match it against your inventory, and send only what's yours — plus a log proving the rest was checked.
Do you work with large enterprises?
No. If you have a security team and a scanning platform, you already have what we make. We're built for organizations without one — and for the households and family offices of the people who run organizations that do. That second part is the private-client practice.
Do you cover homes and personal technology?
Under a private-client engagement, yes: home networks, storage, smart-home equipment, cameras, travel devices — by inventory only, never by access. Details on the private-client page.
We're small. Are we really a target?
Most compromise is opportunistic: automated scanning finds an unpatched edge device and doesn't check your headcount first. And your insurer asks the question either way.
What if nothing affects us for a month?
Then your briefings say so, with the math: “reviewed 61, 0 relevant.” That documented all-clear is the deliverable your auditor and insurer want.
How do you know what we run?
You tell us once during onboarding (guided, ~30–45 minutes), we review it together quarterly, and you email us when something changes. We never connect to anything to find out.
You're holding a list of our software. Isn't that a risk?
Fair question — we built for it. Your inventory contains product names and versions only: never IP addresses, credentials, network maps, or configurations. It's encrypted at rest, only the analyst can read it, and it's deleted when you leave. Details on the security page.
Will you ever name us as a client?
No. We don't publish client names, case studies, or testimonials, for anyone, at any size. It's policy.
What's your alert SLA?
Critical, actively exploited issues matching your stack: within 1 business day (Essential), same business day (Professional), or 4 business hours (Premium). Routine items wait for Wednesday.
Do you fix the problems?
No — and that's deliberate. We're advisory-only and zero-access, which is why we're safe to hire in an afternoon. Every item is written so your IT person or MSP can act on it without translation.
Will this satisfy our WISP or insurance requirements?
We can't certify compliance — nobody honest can promise that by email. What we provide is the documented monitoring activity those requirements ask about: logged weekly reviews and periodic evidence reports, formatted so an insurer or auditor has something real to look at.
What's the difference between the free Wednesday Brief and a subscription?
The free edition covers the generic small-business stack. A subscription is matched to your inventory: what applies to you, what to do about it, what was checked and didn't apply, same-day alerts when something on your list is being actively exploited, and the evidence log behind all of it.
What's the commitment?
Month to month. Cancel by replying to any briefing. Onboarding is one-time; your inventory list is yours and leaves with you.
See what last week would have looked like for a stack like yours.
A person replies within two business days. No call required.