The security baseline for a company without a security team: five read-only, self-hosted tools that roll every finding into one board-ready report.

Inside (five tools, one licence)

• TenantWatch — M365/Google Workspace posture: MFA gaps, risky OAuth apps, forwarding, sharing, risky sign-ins
• DmarcWatch — who sends as your domain, spoofing, safe path to p=reject
• CertLight — TLS expiry and weak-config monitoring
• Attack Surface Monitor — what is exposed to the internet, diffed daily
• Posture Report — the anchor: one score, Executive and Technical pages, prints to PDF

Compliance, evidenced honestly: mapped to the controls behind ISO 27001, CIS, GDPR and UU PDP — evidence for an auditor, not a certification claim.

Server requirements (all five on one host)

• Linux x86-64; five static binaries (~10 MB each) or Docker; SQLite files, no database server
• Measured idle: ~10 MB RAM per tool, ~50 MB for all five
• Minimum host: 1 vCPU, 1 GB RAM, 5 GB disk — a small VPS
• Ports 8422/8423/8429/8430/8432 (localhost by default); outbound only to Microsoft/Google APIs, CT logs and your own domains

Buying these five separately is $115/mo. Essentials is $59/mo Pro and $149/mo Team, both with a 14-day trial. Need log correlation or firewall audit? See Hexward Suite.

AI Assist (optional, offline): Explain any finding on your own hardware; the engine still decides.

Whop sells paid licences only. Free editions: github.com/nizartuanku