For MSPs, vCISOs and fractional CISOs
You design the plan. We witness the test.
You can run a tabletop exercise for your client. You cannot be the independent witness to it.
If you wrote the incident response plan, configured the backups and operate the environment, an attestation with your signature on it is the builder marking their own work. That is exactly what an underwriter or an enterprise security questionnaire is written to get past.
So keep the relationship, keep the remediation work, and hand off the one part you are structurally disqualified from providing.
Worth 20 minutes to see whether it fits the clients you actually have?
Book a 20-minute partner callScope
What can you attest to, and what can you not?
| The claim your client has to make | Can you be the one who attests to it |
|---|---|
| Backups are configured and tested | Yes, you hold the evidence |
| Multi-factor authentication is enforced on remote access | Yes, your tenant and your policy |
| The incident response plan exists and is current | Yes, you wrote and version it |
| The plan has been tested | Partly. You can say it happened |
| An independent party observed the test and signed for it | No. Not available to anyone who built the controls |
One line out of five. That is the whole scope of what we do, and it is why this is a hand-off rather than a competitor arriving.
Why it matters more for your clients
Does company size change the exposure?
It changes it a lot, and not in your clients' favour. Organisations in the size band you serve are the least likely to stop an attack before it lands, which is the band underwriters are scrutinising hardest right now.
of organisations with 100 to 250 employees stopped a ransomware attack before their data was encrypted or stolen.
Sophos, State of Ransomware 2026, 2026. Source
of organisations with 3,001 to 5,000 employees stopped one at the same stage. Your clients sit on the wrong side of that gap.
Sophos, State of Ransomware 2026, 2026. Source
That gap is usually not a tooling gap, and you would know if it were, because you bought the tooling. It is a decision gap. Who has authority to declare an incident at six on a Friday. Who calls the insurer, and how early. Whether anybody in the room has said the words we are not paying out loud before the day it matters.
None of that surfaces in a monitoring dashboard. It surfaces when the leadership team has to decide under time pressure with somebody neutral writing down what they did.
The Carrier Acceptance Guarantee
If their insurer won't accept the report, we rewrite it until they do.
Your introduction carries no acceptance risk. If it does not work as evidence, it is not finished. That is our problem to fix, not yours.
The split
What does a real engagement look like from your side?
You tell us where you think it breaks. We build the scenario around that and run the session. You sit in as a participant if the client wants you there, and you get the report at the same time they do, not filtered through them.
The report lands 15 days after the session with a prioritised gap list, each item carrying a named owner and a date. Most of those owners are you. That is the point, and it is work we neither want nor could take.
The Carrier-Ready Tabletop is $15,000 CAD, fixed. If you want to see the shape of the thing before you introduce anyone, the tabletop agenda and report template is the actual structure we run, including what the attestation page contains and why a self-run version of it does not carry.
Frequently Asked Questions
Should an MSP offer tabletop exercises?
Run them, yes. Attest to them, no. Running regular exercises for your clients is good practice and you should. But if you wrote the incident response plan, configured the backups and operate the environment, your signature on an attestation is the builder marking their own work. Underwriters and enterprise security questionnaires are specifically written to get past that. The exercise that has to survive outside scrutiny needs someone who did not build the thing being tested.
Are you going to compete with us?
No. We do not sell managed services, monitoring, endpoint tooling, or remediation work of any kind. We run a three-hour exercise and write a report. Every gap that report surfaces needs somebody to fix it, and that is you. We have no interest in that work and no capacity for it.
What does "you design, we witness" mean in practice?
You know the environment, so you tell us what should be tested and where you think it will break. We build the scenario around that, run the session with the client leadership team, and write the report. You are welcome in the room as a participant. You are not the facilitator and you do not sign the attestation, because those are the two things that would undo the independence you are bringing us in for.
Will the report make us look bad?
It will say what happened. In practice the findings are almost always about decision-making rather than technology: who has authority to declare an incident, who talks to customers, how long the room takes to reach a call. Those are governance gaps, not MSP failures. A report that surfaces them usually strengthens the case for work you have already been recommending and not getting signed off.
Can we refer clients and take a margin?
MSPs are not regulated the way insurance brokers are, so a referral arrangement is possible where you want one. We disclose it to the client either way. The specifics belong on the partner call rather than on a web page.
What do you need from us to get started?
An introduction, and whatever incident response, business continuity and communications documentation the client already has. If that documentation is thin, that is useful information rather than a problem, and it lands in the report as a prioritised gap with a named owner and a date.
Do you take over the client relationship?
No. The engagement is a fixed scope with an end date. We do not add the client to a marketing list, we do not approach your other clients off the back of an introduction, and we do not stay in the account after the report is accepted.
Start with a conversation, not a client.
20 minutes to work out whether the hand-off makes sense for the clients you have. No client name required, and you leave with the co-branded one-pager either way.