What VXSec can implement
Implementation is limited to approved, scoped cleanup work. The work can follow a VXSec diagnostic, a partner-provided finding list, or a clear internal backlog.
- Disable or remove confirmed stale users, guests, contractors, and external collaborators.
- Reduce admin roles and document who owns privileged access.
- Transfer ownership for shared inboxes, shared drives, files, automations, workspaces, and client handoff points.
- Clean up SaaS seats, workspace owners, billing owners, and tool admins.
- Add basic cloud guardrails such as budgets, alerts, tagging cleanup, and access hygiene.
- Set AI tool access controls, inventory, approval steps, and offboarding tasks.
- Update offboarding workflows so the same cleanup does not repeat every quarter.
Pricing tiers
$2,500 to $3,500. One system or a short list of low-dependency changes.
$5,000 to $7,500. Multi-system cleanup with owner approvals, documentation, and workflow fixes.
$8,000 to $12,000. Agency systems, cloud, AI tools, automations, or multiple owner groups.
Extra systems, new findings, or higher-risk changes are quoted before work expands.
Approval and change control
VXSec prepares a change list before implementation. Each change is marked as safe to execute, approval-needed, dependency-check-needed, or out of scope. Changes that could affect data, billing, production systems, client access, or integrations wait for explicit approval.
Access model
VXSec uses least-privilege access where practical. Some work can be completed from exports, screen share, delegated admin access, or temporary scoped roles. Access is removed after delivery unless a separate agreement says otherwise.
What is excluded
Excluded work includes helpdesk tickets, device support, managed IT retainers, custom app development, broad procurement, emergency incident response, and destructive changes without written approval.
Hypothetical before/after example
Example only, not a real client example: an agency finds former contractors in Slack and ClickUp, a Shopify collaborator no one owns, HubSpot admins from old roles, automations tied to a personal account, and no AI tool inventory.
After a cleanup sprint: approved stale access is removed, owners are assigned, admin roles are reduced, automations are documented, AI tools are inventoried, and offboarding steps are updated for the next contractor exit.
Scope the cleanup before changing access
The scope check confirms systems, access method, likely change count, approval owners, and whether the sprint should follow a diagnostic first.
Book a 15-minute scope check