Security that holds up under attack, and under audit.

Penetration Testing

We act like a real attacker, with permission, to find the ways someone could break in, so you can fix them first.

A vulnerability scan tells you a door is unlocked. A penetration test shows you what someone could walk out with. SimIS offers penetration testing as a distinct service, while many firms use "vulnerability assessment" and "penetration testing" interchangeably. A vulnerability assessment has real value for audit and compliance needs, but it does not expose the true business impact of a vulnerability, or of a chain of them working together. Our team has developed its own methodologies, tools, and techniques for infiltration and privilege escalation, going well beyond running a single scanner and reformatting the output. The value lives in our staff's expertise and their use of customized tradecraft. At your request, our consultants can also employ social engineering to give you a fuller picture of human vulnerabilities.

Penetration testing is an advanced service. Organizations focused on meeting FCI and CUI safeguarding requirements, including NIST SP 800-171 self-assessments and CMMC Levels 1 and 2, generally do not need it, and a periodic vulnerability scan is the better fit. Penetration testing becomes relevant at higher assurance levels and for mature programs that want to validate defenses already in place.

Vulnerability Assessments

We carefully check your systems for known weaknesses without disrupting the ones you cannot take offline.

When the systems you need tested are the ones you cannot afford to take offline, a careless assessment becomes its own risk. SimIS understands the challenge of assessing networks that demand high availability. We use established methodologies, commercial and government tooling, and industry best practices to deliver accurate, valuable reporting while protecting system availability and keeping performance impact on critical systems to a minimum.

Periodic Vulnerability Scans

New weaknesses appear every week, so we check on a regular schedule to catch problems while they are still fresh.

New vulnerabilities are disclosed every week, and the gap between disclosure and exploitation keeps shrinking. Our affordable periodic scans identify weaknesses as they become public. We start by baselining your accessible systems and services, then flag any drift from that baseline so your organization is alerted to what changed. This kind of scanning is easy to automate, but our experts stay involved at each step for a more thorough result. You set the schedule and the scope, and we meet your needs.

Wireless Network Assessment

A misconfigured wifi network can be a hidden back door into your business. We test yours to make sure it is not one.

An improperly configured wireless network is an anonymous back door into your business, and it can lead to compromise of your infrastructure, confidential information, and trade secrets. Securing wireless is difficult against constantly changing technology. Our team has specific wireless expertise and can demonstrate the real security impact of your network, including risk introduced by other networks operating in close proximity.

Web Application Assessment

The apps and websites you and your clients use are a direct path to your data. We test them for ways in.

Custom and off-the-shelf applications are a direct path to the data you and your clients trust you to protect. Our experts have assessed a wide range of highly customized environments using skilled manual testing alongside automated tooling to surface security issues. Whether you built a custom application or deployed a COTS solution, SimIS helps ensure that your data, and your clients' data, stays protected.

Identity and Access Hardening

We make sure only the right people can get into your systems, and that a stolen password alone is not enough.

Shared logins and standing administrator rights are the fastest way for a small compromise to become a total one. We configure named accounts, multifactor authentication, and least-privilege access inside the Microsoft environment you already pay for, so a single stolen password stops being a master key and permissions stop drifting wider over time.

Endpoint and Device Management

Laptops and phones are where a lot of attacks start. We help you keep every device secure and accounted for.

Every laptop that falls behind on patches is an open invitation. Using Microsoft Intune and Defender, often already included in your licensing, we bring your devices under central management and consistent patch discipline. You get a single view of which machines are protected and which need attention, instead of guessing.

Microsoft 365 and SharePoint Secure Configuration

We set up your Microsoft environment the secure way, closing the risky defaults most organizations never touch.

You adopted Microsoft 365 because the work required it, not because anyone configured it to protect sensitive information. Loose sharing settings, overly broad permissions, and files scattered across sites quietly turn into real exposure. We secure how your environment stores and shares data, so the tools your team relies on every day stop working against you.

Documentation and Evidence Architecture

An assessment is only as smooth as the evidence behind it. We design documentation and evidence stores that are efficient to maintain, discoverable when an assessor asks, and repeatable across assessment cycles, so proving your security posture stops being a scramble.

The same architecture serves every audience: your team maintaining it day to day, leadership checking readiness, and an assessor pulling artifacts on demand. We build it in the tools you already run, typically Microsoft 365 and SharePoint, so evidence collection becomes a byproduct of doing the work rather than a project before every assessment.

Incident Response Planning and Tabletop Exercises

We help you plan what to do when something goes wrong, and practice it, so a real incident is not the first time.

If you were breached tomorrow, would anyone know what to do in the first hour? We build your incident response plan and run a practical tabletop exercise against it, which also satisfies the plan-testing that NIST SP 800-171 expects, so your team has a tested playbook instead of improvising under pressure when the cost of a wrong move is highest.

Security Awareness and Phishing Simulation

Your people are the most targeted part of your defenses. We train them and safely test them with realistic phishing.

Your people are the most targeted part of your defense and usually the least equipped for it. We deliver role-based awareness training and run simulated phishing campaigns that show you where the real risk sits and coach your staff before an attacker finds the same gap. Training becomes specific and measurable instead of a once-a-year checkbox.

Hands-On Remediation Support

We do not just hand you a report. We help you actually fix what the assessments found.

Knowing what is broken is the easy part. Getting it fixed, around everything else your team is already doing, is where most programs stall. We drive the actual remediation and coordinate with your IT providers, so findings turn into closed items rather than a backlog that ages.

Fractional Security Program Lead

Get an experienced security leader guiding your program part-time, without the cost of a full-time hire.

The most common reason a security program decays is that no one inside the company clearly owns it. Leadership assumes IT has it, IT assumes operations has it, and the steady-state work falls through the gap between them. A full-time security director would close that gap, but most small suppliers cannot justify the salary. The Fractional Security Program Lead gives you a named, part-time owner who runs the program as though they were on staff. They hold the recurring rhythm, make the scope and access decisions, keep your evidence current for the annual affirmation your leadership signs, manage the relationship with your IT provider, and give leadership a clear read on where you stand. Because they own the program end to end, they are also the backup knowledge it cannot afford to lose, so a single departure stops being a single point of failure. This is the most complete way to keep your posture intact between assessments, and it keeps a senior security partner in the room for every decision that affects it.

Quarterly Program Review

Every few months we step back with you to check what is working, what has changed, and what is next.

Not every supplier needs a program lead on retainer, but every supplier needs someone watching for drift before it becomes a finding. The Quarterly Program Review is a scheduled review and written report that runs the core sustainment checks in a single recurring sitting. Each quarter we confirm what changed and whether it mattered, covering:

• Scope changes from new contracts, tools, vendors, or workflows, and whether each one shifts what you have to protect.
• Access recertification, so the right people still have the right access and standing exceptions get cleaned up rather than accumulating.
• Workarounds that crept back in under production pressure, such as shared accounts or bypassed controls.
• Evidence freshness and a short readiness snapshot that leadership can actually read, so the score you affirm in SPRS stays one you can stand behind.

The work stays light because it runs on Microsoft-native trackers and automated reminders built on tools you already own, so the rhythm holds without adding headcount. When your reliance on an outside IT provider needs a closer look, a shared-responsibility review can be added on. This is the most affordable way to keep your program honest between assessments, and the easiest place to begin.

Recurring Tabletop Exercises

We run regular practice drills so your team stays sharp and your response plan stays current.

A response plan tested once and never again is a plan nobody actually remembers. Skills fade, people change roles, and last year's scenario stops matching this year's threats. Recurring tabletop exercises keep your team sharp by running a fresh, facilitated drill each cycle: ransomware this quarter, a vendor compromise or an insider data spill the next, a lost device after that. Each session puts your people through a realistic decision under pressure, surfaces the gaps that only appear when the plan meets reality, and leaves you with a short list of what to fix. Where the Protect band builds and first tests your incident response plan, this keeps it exercised over time. It is the easiest sustainment service to start with, because the value is obvious the moment leadership sits through one.

Microsoft 365 and SharePoint Governance Drift Review

Secure settings quietly slip over time. We periodically check that yours have not drifted back into risk.

Microsoft 365 environments do not stay clean on their own. Sites multiply, permissions widen as people grant access for convenience, external sharing accumulates, and sensitive files drift into places nobody is watching. Left alone, a tidy tenant becomes a sprawling one, and loose collaboration governance quietly becomes a real security exposure. This recurring review gives you a clear picture of your Microsoft 365 and SharePoint posture: new sites without an owner, permissions that have crept too broad, external sharing that should be reconciled, and where your sensitive content is actually living. You get a concrete report and a short list of what to tighten, on a cadence that keeps the environment from sliding. It pairs naturally with the secure configuration work in the Protect band, and unlike the broader sustainment offerings it delivers value even to a firm that has not started a full program yet, which makes it a strong standalone entry point.