Skip to content
Book a risk assessment

How it works.

From first call to monthly proof, on a clock you can see.

Every step is fixed and shared between you and us. Here's what happens in the first six weeks, who does what, and what keeps happening every month after.

Days 1 to 5
Groundwork
Days 6 to 7
Choose and sign
Days 8 to 13
Deploy
Day 14
Go live
Days 15 to 44
Tune and learn
Day 44
Accept
Every month
Prove and improve
You
A questionnaire, a 90-minute workshop, four impact ratings and a one-hour walkthrough.
Pick packs, sign, approve read-only access and name who we call.
Approve a pilot group and a change window.
Approve a time for the first Fire Drill.
Answer the odd "Was this you?"
Accept the service. Billing starts now, not before.
A 30-minute review call.
Demysti5
Map crown jewels, score maturity, build the risk register and roadmap.
Quote, with platform costs shown separately. Check licences, data location and devices.
Deploy as code: detections, device policies and playbooks. Pilot first, then everyone.
Run a Fire Drill: detections fire, Verdict decides, the right person is told.
Tune noisy rules. Known Normal learns how your business works.
True-up users and devices. Hand over your security context document.
Fire Drill, tuning and a plain-English report.
Your time

About four and a half hours of your time. Over six weeks.

That's everything we need from you to go from first call to accepted service. The rest is automated or ours.

What we need from youMinutes
  • Workshop90
  • Walkthrough of your report60
  • Questionnaire45
  • Impact ratings15
  • Approve read-only access15
  • Accept the service15
  • Name escalation contacts10
  • Pick a pilot group and change window10
  • Approve the Fire Drill time5
Total265 min · 4 h 25 min
Who does what

No grey areas. It's written into your agreement.

Most disputes with security providers start with "I thought you were doing that." This is the list we sign.

Does it Approves or decides
Activity Demysti5 You
Watch every alert, day and nightDoes it
Decide what each alert meansDoes it
Contain an attack within your limitsDoes itSets the limits
Tell you, in plain English, within agreed timesDoes it
Change anything in your systemsDoes itApproves
Fix roadmap items covered by your packsDoes itApproves
Fix roadmap items outside your packsAdvisesDoes it
Own and approve your policiesDrafts and remindsDoes it
Pay platform licences and usageDoes it
Every month

A month with Demysti5, at a glance.

The same rhythm every month, so you always know what's coming and when you'll hear from us.

Report published
Review call, 30 min
Fire Drill
Tuning what the Fire Drill found
New Habits task for staff
Patch window
Policy review reminders
Every dayVerdict on every alert, a threat brief matched to your business, and a check that nothing has gone dark.

Every third month, the review becomes a risk refresh: your register is re-scored from live data and the roadmap re-ordered.

If you leave

Leaving is a process too, and it's on your side.

You shouldn't stay because leaving is hard. You should stay because it works.

  1. 01
    Our access goes first
    Removed from your environment on your final day, with the change logged.
  2. 02
    Your detections stay
    Rules, history and settings live in your accounts. Nothing is switched off on the way out.
  3. 03
    You take your records
    An export of your reports, your risk register and your Known Normal.
  4. 04
    We delete our copies
    On the schedule in your agreement, and we confirm it in writing.

Day 1 starts when you book Groundwork.

Five business days, a fixed price, and a report that's yours whatever you decide next.

Book Groundwork