Most IT problems
look different
on the surface.

They were winning every room they walked into. Sharp pitch, credible team, genuine sustainability expertise that enterprise clients actually wanted. But somewhere between the final presentation and the purchase order, they kept losing. Not on price. Not on capability. On a four-page security annex that came attached to every procurement process — and that they had absolutely nothing to put in.

The Baseline Posture Audit made it concrete: 120 people across unmanaged devices, SaaS tools provisioned by whoever needed them that week, and no single record of who had access to what. No identity provider, no MDM, no offboarding process, no documented controls. Not a security crisis — just a company that had grown fast without anyone ever owning IT.

Device fleet enrolled and managed. Identity centralised with SSO and phishing-resistant MFA. Offboarding automated so access revocation happens in minutes, not months. An access matrix built and documented. And a compliance checklist — mapped directly to the security annexes they kept facing — that could be completed in an afternoon instead of left blank with an apology.

Six months of careful sales work. A champion inside the account, budget approved, legal moving. Then procurement sent a 180-question security questionnaire with a five-day response window. The answers were scattered across three Slack channels, two people who had already left the company, and one engineer who half-remembered what was set up two years ago. The deal didn't die — but it came within a week of it.

No centralised identity provider. Devices unmanaged. No documentation of who could access which systems or how access was removed when someone left. The questionnaire wasn't unreasonable — the controls just didn't exist yet, and the ones that did weren't written down anywhere that could be shown to a bank's security team.

Identity stack consolidated. Device fleet enrolled with encryption enforced. An access control matrix built from scratch. A security questionnaire response template created — mapped to the controls that were now actually in place and provable. Every claim in it backed by an audit log or a policy document, not a verbal assurance.

One person had owned everything. Device procurement, SaaS provisioning, new joiner setup, the IT helpdesk inbox — all of it lived in one head. They gave two weeks notice and then they were gone. No handover document. No list of what systems existed. Three engineers were due to start the following Monday. Nobody knew how to get them set up.

40+ SaaS applications, most provisioned by whoever needed them fastest. Twelve former employees with active accounts — some going back eighteen months. No identity provider tying it together. Devices managed through a mix of a spreadsheet and institutional memory. None of this was negligence. It was what happens when a company grows 4x in two years without anyone owning the infrastructure layer.

Full access audit and triage. All twelve ghost accounts closed. Identity provider implemented with SSO across every major tool. Device fleet enrolled. Lifecycle automation connected to HR — so provisioning and de-provisioning are triggered by the same workflow that handles contracts and start dates, not a Slack message to someone's personal inbox.

The term sheet came through on a Tuesday. By Thursday, the lead investor had sent a technical due diligence list. Halfway down was a section on IT security controls — device management, access governance, incident response, encryption standards. The founding team looked at each other. Nobody had a clear, documented answer for a single item.

Unmanaged devices with no encryption enforcement or proof. No formal access governance — people had admin rights in tools they'd forgotten they had. No audit trail for onboarding or offboarding. Good intentions, zero documentation. The security controls that existed were real — they just weren't organised, verifiable, or presentable to an investor's technical team.

The Baseline Posture Audit gave them a precise gap map — what existed, what was missing, what needed to be built. Six weeks of implementation: devices enrolled, encryption enforced and provable, access governance formalised, audit logs structured, and a full evidence pack assembled — built to answer the exact questions an investor or auditor would ask.