What we will not do, in writing, so you can send this to your client.
For managed service and advisory firms. Send the URL as it is. It needs no covering note.
What we do not sell, and where the work goes.
| We do not sell | Instead |
|---|---|
| Round the clock monitoring, a security operations center | Nobody here watches alerts overnight. Its design: Cyber Defense. |
| Managed detection and response | Not sold here. The review of detection coverage and response readiness is. |
| Managed patching | Deciding what is fixed first, and verifying it: Vulnerability Management. |
| Help desk and managed IT | Whoever runs the environment keeps running it. |
| Incident response execution | A client in an incident calls its insurer's breach counsel and the policy's response provider. |
| Legal advice | Counsel owns the legal reading of every instrument named on this site. |
| Product and platform sales | We govern what a client deploys and review what a vendor sells. |
We sell no managed services, so we do not compete for your contract. The difference between a boundary and a courtesy is where it is written: here and on Trust and Assurance, where your client's file can hold us to it.
We will not judge a program we own.
Our advice is not tied to product sales. If Red Stick Solutions ever holds a commercial relationship with a product or platform it discusses with you, that relationship is disclosed to you in writing before it can affect the advice.
The policy, in the words used wherever this site states it:
Red Stick Solutions will not assess or test a security program it owns as virtual CISO for the same client in the same period. Where a client wants both, the assessment or the test goes to a third party and this firm helps select one.
Disclosures go to you too. Judging your own work and testing it are the same conflict, and it arises in any advisory or vCISO engagement.
When the client is yours.
You keep it. We do defined work as an independent party; remediation on systems you manage routes back to you.
Findings about your work go to you first, with time to respond, in a window agreed at the start. Nobody on your side learns of it in a meeting.
Your client's third party rules put us both in its vendor file. Which rules, whom they reach and where responsibility sits: Trust and Assurance.
Four cases where another firm is better.
- A regional accounting firm with an IT audit or SOC practice, for an attestation report or opinion; we issue neither.
- A national penetration testing firm, for a commodity external test of a fixed address range.
- A managed provider extending into advisory, when the client wants one party accountable for operations.
- An AI governance platform vendor, once the client has chosen to buy one.
Referrals work the same both ways.
One that arrives comes back to you with what was scoped and declined. Work referred out is named by category, not by firm.
Red Stick Solutions pays no referral fee and accepts none.
We refer work because it belongs there, and will state any change here before acting on it.