See what your security actually covers.
Answer seven questions about your whole estate. Get a one-page report, in language anyone in the business can read without translation.
Audit your estateSecurity is invisible when it works, so nobody asks what is actually covered until a renewal, an audit or an incident forces the question. Most organisations have no clear way to show it, so it gets pieced together by hand once a year, if at all. Answer seven questions about your estate and the Estate Coverage Check writes that page instead: every area of your environment, what covers it, and how closely it is watched. The areas that come back quiet are your next conversation.
The report is your document. Your logo, your colour and your company name are the only branding on it.
Name what covers your estate. Get the one-pager.
Answer endpoint first if you are not sure where to start.
The report is written when you run it. Nothing is shown until then, so what comes back is the whole picture at once.
Nothing you enter is stored against a name or an account. Your branding stays in this browser, and you run it again whenever the estate changes.
Security coverage report
This report sets out the areas of your estate, what each area covers, and how closely it is watched. It describes the arrangement in place on 23 October 2026.
| Area | What it covers | How it is covered |
| Endpoint | The laptops, desktops and servers your people work on. | Not monitored at present. |
| Network | The connection between your sites and the internet. | Not monitored at present. |
| Identity | Who can sign in, and what each account is allowed to reach. | Not monitored at present. |
| Messages arriving from outside your organisation. | Not monitored at present. | |
| Cloud | Microsoft 365 and the cloud services that hold your data. | Not monitored at present. |
| Backup and recovery | The copies of your data, and the ability to restore them. | Not monitored at present. |
| OT and IoT | Cameras, door entry, sensors and other equipment on your network. | Not monitored at present. |
Findings are reviewed during working hours and raised with you through your usual support channel. There is no overnight or weekend review in place at present.
Endpoint, Network, Identity, Email, Cloud, Backup and recovery and OT and IoT are not monitored today. We have set out separately what covering them would involve.
What each answer means.
Every area comes back as one of six answers. Anyone reading the report sees the plain wording. The suggested next step is for you.
The report carries your logo, your colour and your name. Nothing on it mentions us.
Watched around the clock
Records from this area reach a security team that reads them at any hour, including overnight and at weekends.
Collected
Records are gathered in one place and reviewed during working hours. Anything that happens overnight waits until the morning.
Tool only
A product is installed and protecting the systems, but its records stay inside the product.
Not monitored
Nothing is watching this area at the moment.
Outside this audit
Another team looks after this area, or it sits with an outside supplier.
Not present
This area does not exist in your estate, so it is marked as not applicable.
Run it now, then again whenever it changes.
Run it today to see where you stand, hand the page to the board or your insurer at the next review, then run it again once something changes. You get a picture you can act on, and something to point at when someone asks what happens next.
Why the report has seven rows.
Security products cover areas, and most cover more than one. The report is laid out by area rather than by product, so anyone reading it can take in one row at a time. Each area keeps its own colour throughout.
What counts as part of the stack?
Anything in your environment that keeps a security record. Agents, firewalls, identity providers, mailboxes, cloud tenants, controllers and sensors. It belongs on the report whether IT put it there or another team did.
Why is connected different from watched?
A connected source records what happens. A watched source has someone reading those records, including overnight and at weekends. The report says which of the two is in place for each area, because the difference decides how long something can go unnoticed.
How does it treat OT and IoT?
As an area of its own, below the IT stack. Cameras, door entry, sensors and plant equipment use different protocols and rarely appear in an IT console. It gets its own row so the report has an answer for it either way.
Questions
Book a call.
Thirty minutes with Hannah Lloyd, our co-founder and CRO. Which areas are worth covering first for an estate like this one, what a 24/7 team changes, and how the numbers work for an organisation your size.
Book a callFind out more
This tool is one part of a free library.
Labs is free prompts, playbooks, templates, skills and automations for MSPs, updated daily. Sign up and all three free tools, this one, Coverage Statement, and Tender and Insurance Answers, are free to use.