What our customers get
Every month, you find out exactly what’s on your network.
Andrew Igloo watches it around the clock. This is what he writes down — what he found, what it means, and what we did about it.
Most providers hand you an invoice and a dashboard login. We hand you a written record.
Why you get one
“Everything’s fine” is not a status report.
Ask most IT providers how your network is doing and you get a shrug and a green dashboard. Ask ours and you get eight pages with the settings printed on them.
That matters because the things that take a business down are quiet. A backup internet line that died in January. A camera that stopped recording three weeks ago. A password that’s been on all twenty-five devices since the last vendor set it that way.
None of those raise an alarm. All of them show up in the report.
What’s in it
Eight areas, every time
Same eight every month, so you can put two reports side by side and see what moved.
Your firewall
Whether it’s filtering anything, and what’s reachable from the open internet right now.
Your networks
Whether guest Wi-Fi is genuinely separated from the computer that runs payroll, or separated in name only.
Your Wi-Fi
Coverage, interference, encryption, and the business next door sitting on your channel.
Who can get in
Shared logins, factory-default passwords, and what happened to access when somebody left.
What’s watching
What Andrew caught this period, what he escalated, and what turned out to be nothing.
Your backups
Whether the second internet line actually carried traffic and whether your config backups hold real restore points.
Your phones
Whether the voice network stayed separated and prioritized, and whether anyone tried the phone system from outside.
Your cameras
Which ones were recording, which ones dropped, and for how long.
How it reads
Ranked, evidenced, and fixed
Ranked by what actually matters
Critical, high, medium, low — ordered by what it would cost you, not by which label sounds scariest. A two-minute fix can outrank a big structural one.
With the evidence attached
Every finding names the exact setting and the value we read. You’re not taking our word for it, and neither is anyone you forward it to.
And checked again next time
The next report runs the identical test and puts them side by side: what was open, what’s closed, what’s still sitting there.
See one
A real report
This is the whole thing, not a summary of it.
Client details changed. The findings, the format and the method are exactly what we produce.
Example Millwork Co.
Corporate office, plant, branch · 25 managed devices, 3 older switches · 10 networks across 3 sites
The summary
The network works and was built reasonably well. In three places it’s wide open in ways nobody chose. Two are settings changes. One needs a maintenance window. None of it needs new hardware.
The scorecard
| Area | Grade | Why |
|---|---|---|
| Firewall | D | Three ways in from anywhere on the internet |
| Network separation | F | 10 networks, 3 rules, nothing enforced between them |
| Wi-Fi | B | Encryption current; one old network still in legacy mode |
| Access & passwords | D | One password, readable in plain text, used on all 25 devices |
| Monitoring | C | Threat detection watching but not blocking; no logs kept |
| Backups | D | Backup scheduled and holding zero restore points |
| Phones | B | Voice network correctly separated and prioritized |
| Cameras | F | Recorder reachable from the open internet |
CRITICALC1 — An unknown device was handing out addresses on the shop floor
What happened. Tuesday 7 April, 07:40. Order picking stopped. Scanners couldn’t reach the ERP. The shipping station couldn’t print labels. At 09:50 it fixed itself, when somebody unplugged “the little white box on the shelf by the sander” to plug in a fan.
That box is a consumer router an employee installed to get better Wi-Fi in the finishing bay. It was handing out its own network addresses. Any machine that asked got one, and then couldn’t reach the ERP, the printers or the internet.
What we read:
// Approved address servers, from the gateway
[
{ "name": "CORP-HQ", "vlan": 20, "subnet": "10.21.20.1/23", "dhcp": true, "guard": false },
{ "name": "SHOP-OT", "vlan": 40, "subnet": "10.22.40.1/24", "dhcp": true, "guard": false },
{ "name": "WHSE-WIFI", "vlan": 80, "subnet": "10.22.80.1/24", "dhcp": true, "guard": false }
]
// Protection disabled on 23 of 23 networks. No exceptions.
What was actually answering:
| Address | Device | Handing out addresses? | Approved? |
|---|---|---|---|
| 10.22.40.1 | Your gateway | yes | ✓ yes |
| 10.22.40.212 | Unknown — consumer router, outside port | yes | NO |
| 192.168.1.1 | Same device, inside port | yes | NO |
{ "ip": "10.22.40.212", "vendor": "consumer-router-vendor",
"open_tcp": [80, 443, 53], "open_udp": [53, 67, 1900],
"first_seen": "2026-01-19", "hostname": null }
It had been there since 19 January — 78 days before it broke anything, answering DNS the whole time. Most days the gateway won the race, because machines renew one at a time. Tuesday morning everyone powered on at once, dozens of requests went out together, and the closer device won most of them. That’s why a fault from January showed up as one bad Tuesday.
Alerts raised before we arrived: zero. Two hours of stopped production, no ticket, no record, no warning — because nothing was looking for it.
What we did:
| Step | What | How long |
|---|---|---|
| 1 | Pulled the device. Shut and labelled the port. Put a proper access point in the finishing bay so the Wi-Fi complaint that caused this actually got solved — otherwise the box comes back. | 30 min |
| 2 | Turned on address protection across all 23 networks, with your real gateways listed as approved in the same change. Doing it without that list takes the site down. | 45 min |
| 3 | Same protection on the three older switches, which the controller can’t reach. | 1 window per site |
| 4 | Told Andrew to alert on any new device that starts handing out addresses, so the next one gets caught the same hour. | 45 min |
CRITICALC2 — One password, readable in plain text, on all 25 devices
The same password unlocks the gateway, every switch, every access point and the camera recorder — and the system stores it in a form that can be read back. No second factor on the admin account.
What we did. Turned on the second factor immediately. Unique passwords per device scheduled for the next window.
CRITICALC3 — The cameras and a desktop were published to the internet
rule 3 anyone -> 10.20.0.44:8000 (camera recorder) rule 7 anyone -> 10.20.0.12:3389 (remote desktop) rule 9 anyone -> 10.20.0.44:554 (camera video feed)
What we did. Deleted the rules. Both now reached over the VPN you already pay for.
HIGHH1 — Ten networks, three rules, nothing between them
# Rules restricting traffic between internal networks: 0 # # Anything on any network can reach anything on any other network, # because nothing says otherwise.
The separation exists on the diagram. It doesn’t exist on the network. Scheduled for the next maintenance window.
Next report, 45 days on
| Then | Now | |
|---|---|---|
| C1 | Open | Fixed — device gone, protection on 6 of 10 networks |
| C2 | Open | Half — second factor on, passwords not yet split |
| C3 | Open | Fixed — all three rules gone, access via VPN |
| H1 | Open | Open — maintenance window booked |
Three of four closed in six weeks. H1 stays on the list until it’s done.
Why it’s written down
A dashboard tells you the lights are green. This tells you why.
You own it
It’s your network and your document. Forward it to your insurer, your accountant, your board, or the provider you’re comparing us against.
It answers the forms
Insurers and customers ask whether your network is separated, whether remote access is controlled, whether anything is logging. Those answers are in here, written down instead of guessed at.
It proves the work
Every fix we bill for shows up in the next report as closed, half-done or still open. You can check.
It builds a history
By the third one you can see what your network does over time — what drifts, what breaks, what keeps coming back.
Andrew Igloo does the watching. The report is where it lands.
Common questions
Straight answers
What's actually in the report?
Eight areas, every time: your firewall, how your networks are separated, your Wi-Fi, who can get in and with whose password, what Andrew caught, whether your backups and backup internet work, your phones, and your cameras. Each finding is ranked critical to low with the exact setting we read and what we did about it.
How often do I get one?
On a schedule we set with you. Each one runs the identical test as the last, so you can put two side by side and see exactly what moved, what closed and what's still open.
Do I need to be technical to read it?
No. The top of every finding is a plain sentence about what happened and what it means for the business. The settings, the addresses and the evidence sit underneath for whoever wants them — your own IT person, an auditor, or an insurer.
Can I show it to somebody else?
It's your document. Send it to your insurer, your board, your accountant, or the provider you're comparing us against. We'd rather you had something real to compare than take our word for it.
Does reading my network disrupt anything?
No. Collecting the report is read-only — we're reading settings, not changing them. Phones keep ringing and Wi-Fi keeps working. Changes happen separately, in a scheduled window, after you approve them.
What if something in the report doesn't get fixed?
It stays in the next report marked open, and the one after that. Structural fixes need a maintenance window and sometimes they wait — but they don't quietly disappear off the list.