A digital audit tells you what you own and who can get into it.
Software drift happens in any business. Someone started using Trello to keep track of things. The employee who left three years ago didn't get all their accounts removed. I go and look, then write it all down in language you can act on.
The person who set all this up for you left four years ago.
Your domain is registered to an email address nobody checks. The web designer who built the site still has the only password to the hosting. There's a bookkeeper who left in 2022 whose login was never turned off, and a shared password that three people use because it was easier that way.
None of that is unusual! It's what happens when a business grows faster than its paperwork. The trouble is you can't fix, secure, or hand off a thing you can't see — and the first time most owners get an inventory of their digital life is the week something has already gone wrong.
An audit will help you discover as much of those hidden things as possible before one of them blows up and you get blindsided.
What I look at
There are about nine categories of things I need to look through. Many of them I can do independently, but some will require some info or data from you.
Email authentication
Whether a stranger can send mail that looks like it came from your address, and what it would take to stop them.
Domain and DNS
Who the domain is actually registered to, when it expires, whose card renews it, and who can change where it points.
Website and hosting
What the site is built on, where it lives, who has the keys, and how far behind it has fallen.
Logins and who has them
A list of every account the business depends on and every person who can currently get into it.
Reused and breached passwords
Which of your credentials have already turned up in someone else's data breach, and whether they still work.
Backups and recovery
Whether backups exist, whether anyone has ever tested restoring one, and how long you'd be down.
Payment and banking touchpoints
Every place money is quoted, invoiced, or received, and how easily an instruction could be faked.
Old and abandoned accounts
Services you stopped using but never closed, still holding your data and sometimes still paid for.
Vendors and contractors
Which outside people have access to what, and whether that access should have ended already.
How it runs
A short call or meeting to set the scope
Twenty to thirty minutes. We'll talk about what the business runs on and what you already suspect needs attention. I'll tell you what I can check from outside and what information and access I'll need from you.
I go and look
Most of the first pass needs nothing from you — domains, email records, hosting, and breach exposure are all visible from the outside. I'll come back with a short list of things only you can answer.
You show me the rest
Where the scope needs it, read-only access is enough, and you can sit with me while we do it. Anything you'd rather not hand over, we note as unchecked rather than guessed at.
Report and walkthrough
You get the written report first so you can read it on your own time, then we meet or get on a call and go through it in order of what I'd fix first.
What you get
A written report, and then a call where I walk you through it. The call matters more than the document — it's where you get to ask "so what do I actually do about that one" and get a plain answer.
The report is written for you, not for a technician. If you later hand it to whoever looks after your website, it'll make sense to them too.
An inventory of what you own and what it costs
Who has access to each of it, including people who shouldn't
What's exposed, written as what could happen rather than a severity score
A fix list in the order I'd do it, separating the afternoon jobs from the projects
What I couldn't check, and why
The audit ends when the report does.
You can take the list and work through it themselves, or hand it to the person who already looks after your site. The findings belong to you!
If you'd rather I did the fixing, I'll quote the items you want done. You can pick some, all, or none of them. If you'd rather I kept an eye on things from then on, there are monthly care plans for that. Neither is a condition of the audit, but it is often a logical next step.
Regardless of what you choose, you'll have a clearer picture and know how you can have fewer ways to get hurt.
Tell me a bit about your business and I'll tell you what an audit would cover.
Email me what you've got — a website, a domain, however many staff. No mailing list, no automated follow-ups, just a person reading it.