ALM Security Assessment
Configuration assessment, automated network penetration testing, remediation re-testing, and cyber insurance readiness, reported in language your leadership can act on.
Security assessment from people who run infrastructure
ALM Security Assessment is the assessment practice of ALM Technology Solutions, led by Adam Mark. We assess the kinds of environments we build and operate alongside in-house IT teams: Windows and Active Directory domains, Microsoft 365 and Google Workspace tenants, virtualization clusters, firewalls and VPNs, and the plant-floor networks that sit behind them.
Every engagement is scoped and authorized in writing before work begins. Findings come back prioritized, with remediation guidance, and we review them with your team.
What the practice covers
Configuration Assessment
A structured review of how your Active Directory, Microsoft 365, Google Workspace, firewalls, and network are configured, using the same tools and benchmarks we use in the environments we help run. It covers privileged accounts, password and Kerberos hygiene, legacy protocols, Conditional Access, mail authentication, and external exposure. You get findings ranked by risk and a remediation plan.
Network Penetration Testing
Internal and external network penetration testing on an automated platform, run under signed authorization and supervised by us. Internal tests attempt what an attacker on your network would: discovering hosts, capturing and testing credentials, exploiting misconfigurations, and chaining weaknesses toward sensitive systems. We review the results with your team, rank what matters, and turn the findings into tracked remediation tasks. Available as a one-time baseline or on a recurring schedule.
Remediation Re-testing
After a finding is fixed, by your team or by us, we re-test it to confirm the patch, configuration change, or compensating control closed the gap. We record the result so leadership can see what is closed and what remains.
Cyber Insurance Readiness
Insurers scan your perimeter and ask detailed technical questions before they renew. We complete the technical sections of the questionnaire with you, fix what the insurer's scan finds, and keep a record of your domains and controls for the next renewal.
Incident Response
When an account is compromised, a server is breached, or your users are targeted, we lead the response: containment, log review, credential rotation, and hardening to close the path the attacker used. Leadership gets a plain-language write-up of what happened and what changed.
Reporting to Leadership
For ongoing clients, findings, remediation progress, and re-test results feed the posture updates and annual report leadership already gets from us, so the people approving the budget can see what changed and why.
How an engagement runs
Scope and authorize. We agree on the systems, networks, and accounts in scope, the testing window, and anything that must not be touched. The system owner signs the authorization before we proceed.
Assess or test. We run the configuration review or penetration test within the agreed window, with a point of contact on both sides for the duration. We work remotely. Internal testing runs from a small virtual machine your team deploys inside your network, so no site visit is needed.
Report. You receive a report with an executive summary, prioritized findings with evidence and remediation guidance, and a walkthrough with your team.
Re-test. Once the fixes are in, we re-test the findings and record what is closed and what remains.
ALM Security Assessment is built for organizations with their own IT team. For ongoing clients, the people assessing the environment are the same people who help run it, so findings come with context, priorities, and help carrying out the fixes, and each round of testing builds on the last. For the people who use the systems, we also run security awareness training. We work remotely with organizations across Canada.
Want to know where your environment stands?
Tell us what you want examined and we'll come back with a scope, a timeline, and a plain-language quote. No sales pitch.
Contact Us