Outside IT for teams that outgrew doing it themselves.

VXSec fixes broken email and admin access, cleans up Microsoft 365 and Google Workspace, and can stay on to run them month to month. Accounts, licenses, file ownership, connected apps, and offboarding, handled and documented.

Book a scope check See a sample report

The scope check is a free 30-minute call. It ends with a fixed fee in writing, not a pitch.

VXSec · Findings extractSAMPLE-001
  • CriticalGlobal admin held by a contractor who left in March
  • Review14 OAuth grants unused for 90 or more days
  • Review6 paid licenses assigned to inactive accounts
  • ApprovedMail flow restored. SPF, DKIM, and DMARC verified
  • ApprovedRecovery access moved to the business owner
12 findings documentedAwaiting owner approval
Illustrative sample. Real reports carry evidence for every line.

Start where you are

Three ways in. Each one starts with a scope call and a fixed fee in writing.

Urgent

Something is broken

Locked out of email or admin. Mail bouncing. The person who ran IT is gone and the passwords went with them. Rescues get priority scheduling.

Urgent IT Rescue
Fixed fee

Working, but messy

Nobody owns the accounts, access, and licenses anymore. A read-only audit documents all of it with evidence, then we fix what you approve.

Systems & Access Cleanup
Monthly

Handled every month

Keep VXSec after the cleanup. Hires, departures, licenses, and support, run for a per-person monthly fee with the cleanup credited.

The Outside IT Plan

What gets found, fixed, and kept clean

Two questions drive every engagement: what is broken or about to break, and who or what can reach your systems that should not.

  • USR

    Stale users and offboarding gaps

    Ex-employees with live logins, contractors from finished projects, forgotten guests, and departure steps that never got written down.

  • ADM

    Admin role sprawl

    Super admins, delegated roles, and billing owners that no longer match anyone's actual job.

  • FIL

    File sharing and ownership

    External shares, anyone-with-the-link files, and documents owned by accounts that already left.

  • APP

    OAuth and connected apps

    Third-party apps holding standing access to mail, files, and calendars, including tools nobody uses anymore.

  • AUT

    Automations and API keys

    Zapier, Make, and n8n workflows, service accounts, and tokens with unclear owners that fail silently when someone leaves.

  • AI

    AI tools with broad access

    Assistants and meeting bots connected to inboxes and drives without an inventory or an approval step.

The flagship: Systems and Access Cleanup

This is the standard starting point. Phase one is a read-only audit that documents every user, admin role, share, connected app, and automation in scope, with evidence, ranked by risk. Phase two implements the fixes you approve.

  • A findings report with evidence for every line, written for a decision, not a shelf.
  • A cleanup plan you can approve in one sitting, quick wins separated from changes that need sign-off.
  • A change log of every approved fix: what changed, when, and how to reverse it.
  • An offboarding workflow your team can run without us.
  • The license list of paid seats you can stop paying for.
Full scope and pricing Read the sample report
EngagementFee
Audit, single systemfrom $750
Audit, multi-systemfrom $1,500
Cleanup Sprintimplementation of approved fixes$2,500 to $12,000

Fees are fixed in writing at the scope check. The audit fee is credited toward the monthly plan if you take it.

The cleanup guarantee. If the audit does not surface real access risk worth fixing, you do not pay the audit fee, and you keep the findings report either way.

How every engagement runs

  1. Scope

    A 30-minute call confirms systems, team size, and the fixed fee. You get the scope in writing.

  2. Inventory

    Every account, role, share, app, and automation in scope, listed with evidence.

  3. Report

    Findings ranked by risk, each with a recommended action, effort, and owner.

  4. Approve

    You decide what changes. Nothing moves without sign-off.

  5. Fix and hand off

    Approved changes implemented, documented, and handed over with the updated workflow.

The standing rules for your access

  • MFA everywhere, no shared passwords. Named accounts and proper delegation only.
  • Least privilege. Exports, read-only access, or temporary scoped roles where practical.
  • Time-boxed access. Granted for the engagement window, removed at the end, removal confirmed in the handoff.
  • Approved changes only. Nothing is modified without a signed-off change list.
  • Everything documented. What changed, when, why, and how to reverse it.
  • NDA available before any environment details are shared.

Selected work

Delivered project work. Clients are named where written permission exists; the rest is shared privately on request.

Access control platform for a multi-tenant agency

Delivered

An ecommerce agency held login credentials and platform access for a large book of client accounts, with no isolation between clients and no offboarding process for staff who touched them.

Result: a production platform with fail-closed role-based access, per-client isolation, encrypted credential storage, and provisioning and offboarding workflows the agency still runs on.

Handed over
Access model, runbooks, offboarding workflow
Stack
RBAC, row-level security, KMS-encrypted credentials, secret scanning

Google Workspace access governance

Delivered

A support-services organization had grown past its file sharing: personal drives holding company records, no permission tiers, and ownership scattered across former staff.

Result: department-based Shared Drive architecture with role-based access through Google Groups, cleaned-up file ownership, and documented provisioning workflows.

Handed over
Drive architecture, group model, provisioning docs
Stack
Google Workspace, Shared Drives, Google Groups, Admin Console
All selected work

Common questions

What does a Systems and Access Cleanup include?

A read-only audit of every person, app, and automation that can reach your business systems: staff, ex-employees, contractors, admin roles, file sharing, shared inboxes, OAuth grants, automations, and AI tools. It ends with a findings report and a prioritized cleanup plan you approve before anything changes.

Is VXSec an MSP?

VXSec solves the problem people hire an MSP for, with a different shape. Instead of an all-inclusive management contract, work starts with a fixed-fee rescue or cleanup. Teams that want ongoing care take the monthly Outside IT Plan, priced per person, month to month after the first quarter. Bigger projects are quoted separately, so the monthly cost stays predictable.

What do you need access to?

As little as possible. Exports, read-only access, screen share, or temporary least-privilege roles where practical, always with MFA and never with shared passwords. Access is removed when the engagement ends, and the removal is confirmed in the handoff.

What does it cost?

Rescues are a fixed fee confirmed at the scope check. Cleanup audits run from $750 for a single system and from $1,500 for multi-system, credited toward the monthly plan if you take it. Cleanup sprints run $2,500 to $12,000. Migrations are priced flat per mailbox. Every fee is fixed in writing before work starts.

Broken right now, or just done being your own IT department?

Book a scope check: a 30-minute call that ends with a fixed fee in writing. Urgent rescues get priority scheduling.

Book a scope check See a sample report

Urgent? Email [email protected] with the subject "Rescue". Not ready to talk? Start with the free Offboarding Gap Checklist.

  • Fixed fee in writing before work starts
  • Read-only first, approved changes only
  • You keep the report and the documentation