About VXSec
VXSec is an outside IT practice for growing teams on Google Workspace and Microsoft 365. Fixed scope, written fees, approved changes, documented handoffs.
What VXSec is
VXSec exists for one recurring problem: growing teams accumulate systems and access faster than anyone removes them. Ex-employees keep logins, OAuth grants outlive the tools they came from, automations run under personal accounts, and the person who understood it all eventually leaves.
The practice does four things: urgent rescue when email or admin access breaks, fixed-fee cleanup of systems and access, migrations, and ongoing monthly care. Security, identity, and cloud projects are delivered inside those relationships, after a cleanup has produced evidence.
VXSec is based in Toronto and works remotely with businesses across the US and Canada.
How work is delivered
Every engagement runs the same way, whatever its size: scope confirmed on a 30-minute call and fixed in writing, a read-only inventory before anything changes, findings reported with evidence, changes approved by you before they are made, and a documented handoff you keep.
Two rules protect both sides. The fee is fixed before work starts, so there are no surprise invoices. And the documentation is the deliverable: every engagement ends with a report and change log that a future hire, MSP, or auditor could pick up cold.
VXSec does not sell licenses, seats, or bundled products, so the report recommends what the evidence supports and nothing else.
Access and change control
Giving an outside practice visibility into your systems requires trust. These are the standing rules for every engagement, and you can hold VXSec to each of them:
- MFA everywhere. Every account VXSec uses has multi-factor authentication enabled.
- Least privilege. Exports, read-only access, screen share, or temporary scoped roles are preferred over admin accounts.
- Time-boxed access. Granted for the engagement window, removed at the end, removal confirmed in the handoff.
- Approved changes only. Nothing is modified without an approved change list. Risky or dependent changes wait for explicit owner sign-off.
- Every change documented. What changed, when, why, and how to reverse it where reversal is practical.
- No password sharing. Named accounts and proper delegation only. VXSec will not accept shared credentials.
- No uncontrolled automation. No agents, background jobs, or automations installed beyond the agreed scope.
- NDA available before any environment details are shared.
Leadership
VXSec was founded by Yusuf, a systems and access engineer. His working background covers Google Workspace access governance, enterprise application support across Microsoft 365, Salesforce Service Cloud, and ServiceNow, infrastructure and cloud administration on Azure and OVH, and platform and security engineering for a multi-tenant client platform running in production.
He is directly involved in every engagement, and the name on the report is the person accountable for it. Delivered projects are on the selected work page.
Talk to the person who does the work
A scope check confirms your systems, team size, and likely risk areas, and gives you a fixed fee in writing.