for business Book a risk assessment People, process and technology, protected as one by a real security team. In plain English, with every price published.
Flagged on the finance mailbox. Finance is a crown jewel in your Known Normal, so it goes straight to the front of the queue.
Most security operations centres still onboard by spreadsheet, price by quote and report by alert count. None of that suits a business without its own security team.
Workshops, discovery spreadsheets and change requests come first. Your devices stay unmonitored while the paperwork moves.
Then platform and log bills nobody predicted arrive on top.
Alerts get forwarded to you at 3am. Working out what they mean, and what to do, is left to you.
Most attacks start with a person or a missing process. Most SOCs watch the technology and leave your people and policies to you.
You can't see what's covered, and nobody proves the detections actually fire.
Leave, and the detection rules, the history and the know-how leave with them.
Attacks don't stay in one lane. Most start with a person, slip through a missing process and land on technology. We cover all three and join them up.
Security habits for every staff member, built in the Demysti5 app.
The policies and processes auditors and insurers ask for, in plain English.
Detection, response and protection, on the platforms you already own.
Groundwork to start, Known Normal to learn, Verdict to decide, Fire Drill to prove. What changes from business to business is what Groundwork finds.
A short questionnaire and one workshop with your team. No agents to install and no access needed to start.
Groundwork ranks the risks. Every recommended pack names the risk it reduces, across people, process and technology, so you can see why you're buying it and what can wait.
Security that isn't tested drifts. Every month we run real attack techniques, safely, and show you which ones we caught. Misses become fixes, not footnotes.
Each pack has a fixed scope, a published price and a proof you'll see every month. Always On and Device Shield include incident analysis. Rapid Response is sold separately.
Know your real risk in 5 business days, before you spend anything else.
Most alerts are normal work that looks odd without context. Known Normal is that context, kept current. Verdict uses it to decide every alert: a decision model weighs the evidence and shows its reasons, AI explains it in plain English, and an analyst signs off anything serious.
Every fact has a source and a date, so anyone can see why something counted as normal.
The packs businesses like yours usually need, already picked. Groundwork confirms the fit before you commit.
Customer trust, and every enterprise deal waiting on your security questionnaire.
Leaked keys and stolen developer accounts that open up your code and your cloud.
Customer security questionnaires, SOC 2 or ISO/IEC 27001 expectations, and data protection law wherever your users are.
Five attacks small businesses face, played out step by step. Switch to the analyst view for the detail behind the plain English, including the reasons behind each Verdict.
Same goal: stop attacks. A very different experience of getting there.
| What matters | Typical traditional SOC | Demysti5 |
|---|---|---|
| Where it starts | A generic onboarding checklist | Groundwork: a NIST CSF 2.0 risk assessment of your business, with risks you can see |
| What's covered | Your tools. People and policies are left to you | People, process and technology, in one score and one roadmap |
| Time to protected | Weeks of workshops and spreadsheets before anything is watched | Live in days, with onboarding automated |
| When an alert fires | Forwarded to you to interpret | Decided by Verdict against your Known Normal, explained in plain English, signed off by an analyst |
| Price | Quote only, then platform bills nobody predicted | Published pack prices, with platform costs estimated up front |
| Proof it works | An assurance in the contract | Fire Drill: real attack techniques every month, mapped to MITRE ATT&CK |
| What you see | A monthly PDF of alert counts | A live portal: what happened, what we did, what you need to do |
| Platforms | Their platform, on top of the licences you already pay for | The tools you already own, used properly. New ones only when your risks need them |
| If you leave | Detections and history leave with them | Everything stays in your accounts |
Published prices, worked out in front of you. Groundwork confirms the scope before you commit to anything.
Bigger than 500 people? We'll price it with you.
Platform licences and usage are paid to the vendor and estimated separately in your quote.
The working: 168 hours of cover a week ÷ about 34 working hours per analyst after leave and training = 5 analysts. Then 5 × your cost per analyst ÷ 12 months.
Groundwork is our NIST CSF 2.0 risk assessment. You get a risk register, a maturity score, a 90-day roadmap, the packs that would close your biggest gaps and the first version of your Known Normal. The report is yours whether or not you buy anything else.