Why CyberProva exists

The problem we set out to solve

In most small and medium businesses, someone else runs the IT — an internal team of one or two people, or an outsourced provider. They are usually competent and usually busy. But the person who carries the risk is the owner, the chief executive or the finance director, and that person has no way to answer a simple question: are we actually secure?

Asking the people who run your IT whether your IT is secure is not an independent answer. Not because anyone is being dishonest, but because a separate view helps everyone examine the evidence. CyberProva exists to give the person accountable for the risk a view they did not have to take on trust.

How we approach it

• Read-only. We check; we never change your settings. We do not ask for Global Administrator as an API permission.
• Honest about coverage. If we cannot establish something, we say so. We would rather report "not verified" than record a pass we did not earn.
• Plain English. Findings are written for the person accountable, not only for the person implementing.
• Works with your IT team or provider, not around them. Evidence can be requested from them directly without giving us — or them — any additional access.