The security baseline for a company without a security team: five read-only, self-hosted tools that roll every finding into one board-ready report.

Inside (five tools, one licence)

• TenantWatch — M365/Google Workspace posture: MFA gaps, risky OAuth apps, forwarding, sharing, risky sign-ins
• DmarcWatch — who sends as your domain, spoofing, safe path to p=reject
• CertLight — TLS expiry and weak-config monitoring
• Attack Surface Monitor — what is exposed to the internet, diffed daily
• Posture Report — the anchor: one score, Executive and Technical pages, prints to PDF

Compliance, evidenced honestly: mapped to the controls behind ISO 27001, CIS, GDPR and UU PDP — evidence for an auditor, not a certification claim.

Server (all five on one host)

• Linux x86-64; five static binaries (~10 MB each) or Docker; SQLite files, no database server
• Idle: ~10 MB RAM per tool, ~50 MB total
• Minimum host: 1 vCPU, 1 GB RAM, 5 GB disk — a small VPS
• Ports 8422/8423/8429/8430/8432 (localhost); outbound only to Microsoft/Google APIs, CT logs, your domains

Separately $115/mo; Essentials $59/mo Pro, $149/mo Team, 14-day trial. Log correlation or firewall audit: Hexward Suite.

Wazuh/Splunk-ready, every tier: the four scanners export to file, syslog JSON/CEF or Splunk HEC.

AI Assist (optional, offline): explains any finding on your hardware; the engine decides.

Whop sells paid licences only. Free editions: github.com/nizartuanku