Managed Security Program
Praeven gives small and midsize businesses a practical security owner: recurring priorities, reviewed external exposure, business-platform review, and coordination with the people who run your technology.
Scope that matches how small businesses operate
External exposure, business platforms, and workforce devices each need a different kind of review. We agree on the relevant scope before work begins.
Public IP addresses, hostnames, VPN gateways, web applications, email services, and cloud systems that your organization owns or is authorized to test.
Monthly external validation focuses on this approved list. It does not treat employee laptops as public scan targets.
Identity, multifactor authentication, privileged access, sharing, email protection, and other relevant tenant settings.
One Microsoft 365 tenant or comparable business platform can be included when its administrator or service provider supplies the agreed reports and evidence.
Internal endpoint assessment, agent deployment, and ongoing device management require their own authorization, tooling, and delivery plan.
They are not included in the managed program. When a client already has endpoint tooling, its operator can provide agreed high-level evidence for discussion.
Built to work with your provider
Praeven complements an internal IT team or managed service provider. We do not take over their help desk, infrastructure administration, log management, or remediation work.
Your provider continues to operate the environment. Praeven maintains priorities, translates findings into practical decisions, coordinates security work, and helps leadership see what needs attention next.
AI-assisted workflows organize recurring evidence and prepare reporting. Every client-facing recommendation is reviewed by Praeven operators and engineers.
For managed service providers
Praeven works alongside MSPs and internal IT teams that want a clearer security-program layer for their clients.
The provider retains technology operations, help desk, licensing, and implementation work. Praeven supplies recurring security priorities, reviewed external findings, leadership reporting, and a practical way to explain security progress to the client.
A three-month start
Managed programs begin with a three-month initial term so the right people, evidence, priorities, and remediation rhythm are in place.
Confirm business contacts, approved internet-facing assets, service-provider roles, scan windows, available platform evidence, and the first priority list.
Review the first validation and posture evidence, maintain the risk register, and help the organization or its provider sequence agreed fixes.
Confirm ownership, report progress to leadership, establish the recurring review rhythm, and agree on the next quarter’s security priorities.
Choose the operating depth
Prices are monthly. Internet-facing assets, business platforms, response expectations, and any work outside the listed scope are confirmed before the engagement starts.
| Program | External validation | Business-platform review | Program leadership | Price |
|---|---|---|---|---|
| External Exposure ReviewFor organizations that want a reviewed public-exposure view. | Up to 5 approved internet-facing assets; monthly external vulnerability review | — | Concise findings report and monthly results call | $895per month |
| Managed Security ProgramFor a small organization with IT support but no dedicated security owner. | Up to 5 approved internet-facing assets; monthly reviewed validation | One business tenant and agreed identity, access, and configuration evidence | Risk register, monthly review, and up to 2 business-hours advisory hours | $1,895per month |
| Managed Security Program — StandardFor a growing organization that needs regular coordination. | Up to 25 approved internet-facing assets; monthly reviewed validation | One business tenant and expanded agreed evidence review | Risk register, remediation coordination, regular working sessions, and up to 6 business-hours advisory hours | $3,000per month |
| Managed Security Program — ExpandedFor an organization with deeper governance and reporting needs. | Up to 25 approved internet-facing assets; expanded review and executive reporting | One business tenant and expanded agreed evidence review | Biweekly working cadence, policy and vendor work, leadership reporting, and up to 12 business-hours advisory hours | $5,000per month |
| Embedded Security LeadershipFor organizations that need substantial security-program ownership. | Custom approved scope | Custom approved scope | Weekly operating cadence, executive leadership support, and substantial program ownership | Custom scopeleadership engagement |
An internet-facing asset is a public IP address, fully qualified domain name, gateway, application, or cloud system specifically listed in the approved scope. Endpoint assessment, internal scanning, agent deployment, or endpoint management are separately scoped. Programs do not include 24/7 monitoring, active containment, malware removal, forensics, legal advice, breach notification, penetration testing, or testing of third-party systems without their written authorization.
Program additions
These recurring additions are available with an active Managed Security Program. They extend an agreed scope; they are not standalone assessments, and they do not replace a higher tier when the operating cadence needs to grow.
| Addition | Scope | Price |
|---|---|---|
| Additional Internet-Facing Asset BlockManaged Security Program | Adds up to five approved public IPs, hostnames, gateways, applications, email services, or cloud systems to the monthly external-validation list. Available up to 25 total approved internet-facing assets; broader scope moves to Standard or a custom engagement. | $250per month · up to 5 additional assets |
| Additional Business Tenant ReviewManaged Security Program and above | Adds a Microsoft 365, Google Workspace, or comparable business tenant to the agreed identity, access, sharing, and protection evidence review. Requires an agreed evidence source and an authorized tenant administrator or provider contact. | $400per month · each additional tenant |
| Additional Advisory CapacityManaged Security Program and Standard | Adds scheduled time for security planning, remediation coordination, policy decisions, vendor questions, or leadership preparation. Hours are used during the month and do not roll over; work outside the agreed scope is approved before it begins. | $450per month · 2 business-hours |
| Quarterly Leadership ReadoutManaged Security Program and Standard | Adds preparation, a leadership-facing review of progress and decisions, and a written next-quarter priority summary. Expanded and Embedded programs include leadership reporting as part of their operating cadence. | $750per quarterly session |
Industry fit
Managed Security Program is designed for organizations that have IT support but need a security owner who understands their daily operating decisions.
Protect estimates, invoices, mobile work, vendor trust, Microsoft 365, and the systems that keep jobs moving.
Explore field-service securityProtect client communications, files, payment changes, document sharing, and cloud-account access.
Explore professional-services securityCoordinate security around locations, suppliers, staff access, public brands, and customer-facing operations.
Explore hospitality securityWhen a fixed project comes first
Some organizations need policies, ownership, and a prioritized roadmap before a monthly cadence will be useful.
Security Baseline and Security Foundations projects establish that foundation. Praeven can recommend a project before a managed program when current documentation, roles, or controls need attention first.
Prepare. Anticipate. Protect.