A lost deal. Locked files. A customer's payment sent to a scammer's account. ShieldMantis helps small businesses find their security issues, close them out, and get connected to the right vendors, insurers and tools before any of that happens.
Built for teams that don't have a full-time security person.
Thanks for your time over the last few weeks. Unfortunately, we couldn't get comfortable with the security review, so we've decided to move forward with another vendor.
Every document, invoice and customer record on this network is locked.
A message nobody wants to get. Something is wrong, and nobody is sure how wrong.
A customer has paid a fake invoice sent from your own email. Someone has been reading your inbox for weeks.
Who do you call? Which systems are affected? Do you have to tell anyone? Is any of this covered?
Most small teams answer those questions under pressure, after the damage. We help you answer them now, calmly.
It's rarely a hacker in a hoodie. It's money, time and trust leaking out of the business.
Bigger customers check your security before they sign. If you can't answer, they pick someone who can, and rarely tell you why.
Systems down. Restoring from backups that hadn't been tested.
When laptops are locked or email is compromised, the whole team stops. Every day of cleanup is a day nothing ships and nobody gets paid.
Fake invoices and changed bank details are among the most common attacks on small businesses. Once the money moves, getting it back is hard.
Insurers ask detailed security questions. If the answers on your application don't match reality, the policy may not pay out when you need it.
"We've moved our data to a provider with stronger security controls."
Trust takes years to build. After an incident, customers don't always complain. They just don't renew.
Examples are illustrative. The pattern is real.
None of this needs a 200-page policy binder. It needs the right fixes, made in the right order, with someone who has done it before.
An assessment is only useful if something changes afterwards. Every engagement ends with fixes in place, not a report on a shelf.
We look at what you have, what could go wrong, and how much it would hurt. Then we rank it, so time and money go where they matter first.
You get: a ranked risk register in plain English.
We check your setup against recognised controls: logins, devices, cloud, data and suppliers. You see exactly what's in place and what's missing.
You get: a gap report with a prioritised fix list.
Security usually breaks in the hand-offs: onboarding, offboarding, changes, incidents. We fix the weak processes so the fixes stick.
You get: simple processes your team will actually follow.
We help you pick the issues that matter, assign an owner to each, and work them through to closed, with the evidence to prove it.
A security expert on call for the decisions that come up: a customer questionnaire, a new tool, a contract clause, or "should we worry about this?"
You get: straight answers from someone who's seen it before.
When a questionnaire lands, we help you answer it accurately and quickly, and turn the answers into a reusable pack for the next one.
You get: answers you can stand behind.
Closing a gap often means buying something or bringing someone in. We know who's good, and we help you choose without the sales pitch.
Device management, backups, email security, penetration testing. We shortlist vendors that fit your size and budget, and help you set them up properly.
We get your controls in shape for the insurer's questions, so your application is accurate, and introduce you to licensed brokers who cover businesses like yours.
Independent advice on which compliance platform fits your size and budget, or whether you need one yet. We help you compare, run demos and decide.
When you decide a certification is worth it, we introduce you to auditors and make sure you're ready before they arrive.
If we ever have a commercial relationship with someone we recommend, we'll tell you upfront.
Start small with an assessment. Keep going only if it's useful.
A short, focused look at your people, tools and processes. You get a clear picture of where you stand.
We rank the gaps by real risk and by what your customers and insurers ask about most.
We work alongside your team to fix each issue, bring in the right vendors, and keep the evidence.
Light-touch support as you grow, so the next questionnaire is a quick job, not a fire drill.
Between us, we've spent more than 25 years on both sides of security. One of us ran IT governance, risk and audits inside large enterprises. The other spent his career with customers, most recently helping companies through their security audits.
We kept meeting the same kind of company. Small, very good at what it does, and quietly exposed. It was being sold a certificate before it had the basics, losing deals over questionnaires, and had nobody neutral to ask for help.
ShieldMantis is the partner we wished those companies had.
The ShieldMantis founders
Gardeners welcome mantises because they protect the plants. A mantis stays still, watches closely, and acts only on what matters. That's how we work: assess first, then fix exactly what puts you at risk.
We both started in enterprise IT more than a decade ago. One went deep into IT security, governance and audits. The other went into customer success, and ended up helping companies through security audits. ShieldMantis puts both halves together.
Tap any role on the timeline to see what it involved.
Scroll sideways to see the full timeline.
Head of IT Compliance & Support, Large automotive manufacturer
Led an 8-person IT governance, risk and compliance team and a 35-person IT support team. Accelerated ISO 27001 controls and rebuilt the enterprise IT policy.
Co-founder
Fourteen years running IT, security and compliance inside large enterprises. Now brings that discipline to teams of ten.
Email nm@shieldmantis.com
Co-founder
Thirteen years turning unhappy customers into loyal ones. Now spends his days helping companies through security audits.
Email vr@shieldmantis.com
We use established frameworks as the yardstick, so the work you do now still counts later. Certification is your call, on your timeline.
Information security management, trust for service providers, US health data, EU personal data, privacy management and risk management. If you decide to certify later, you'll start from a strong position instead of from scratch.
Something else on your mind? Ask us directly.
Not always. Many buyers mainly want to see that sensible controls are in place and that you can answer their questions clearly. We help you get there first. If a certification becomes necessary, the groundwork is already done.
No. Everything is scoped to your size. A ten-person company needs different controls than a large enterprise, and we treat it that way.
Both. Most clients start with an assessment. From there, we work with your team to close each issue and keep the evidence.
It depends on your size and what you need. After a short intro call, we'll send you a clear quote before any work begins.
We don't sell insurance. We help you get your controls ready for the insurer's questions, so your application is accurate, and introduce you to licensed brokers.
No. We recommend what fits your size, budget and stage, including "you don't need a tool yet" when that's the honest answer. Any commercial relationship gets disclosed upfront.
A few conversations with whoever runs your technology and operations, plus a look at how things are set up today. We'll tell you exactly what's needed before we start.
Yes. We work remotely and across time zones.
Tell us a little about your business. We'll come back to set up an intro call.
Prefer email? Write to us directly.