Free for 3 months for eligible startups. Apply below.
Someone just asked you for security proof. Have it by Friday.
A customer questionnaire, an investor asking about SOC 2, a broker asking for MFA proof. SecValley reads your Microsoft 365, Entra ID and cloud accounts read-only, 5 minutes to connect, and gives you a sealed, dated report you can forward. Eligible startups run it free for 3 months.
You were going to do this yourself, in the portal, at night.
The person who already knows which settings to read earns $199,850+ a year (BLS, top 10% of information security analysts, May 2025). You are not hiring that person this year. The scanner knows the same settings on day one, and it is the only option that also keeps the dated record your customers, auditor and carrier ask for.
- Top 10% of information security analysts (May 2025)$199,850+
- Knows the seven benchmarks and the carrier questionsyes
- Time to hire in a tight marketmonths
- Leaves when the next offer comesyes
Salaries: US Bureau of Labor Statistics, Occupational Outlook Handbook, Information Security Analysts, May 2025: lowest 10% under $75,090, median $129,180, highest 10% over $199,850. Program figures: SecValley Security Posture page.
- 1,000+ controls across seven surfacesday one
- Knows the benchmarks, the carrier questions, the ATT&CK mapbuilt in
- Scheduled scans, every record keptyour schedule
- KAM executive report, PDF, Excel per scanincluded
- Hiring, training, turnovernone
Seven benchmarks, pinned
Every surface evaluated against its CIS benchmark at a named version. 100+ Entra ID controls where Identity Secure Score shows about 20.
The attacker's map, already drawn
Controls bound to the MITRE ATT&CK v19.2 techniques they mitigate or detect. Threat Intel reads your last scan and says which known groups still have an open door.
What underwriters actually ask
Built from carrier forms, with 10+ carriers' severity matrix as data. About 40% answered from the scan. The rest marked not checkable, never assumed fine.
One connection. Every module reads the same sealed record.
Security Posture
Scheduled read-only scans against the pinned CIS benchmark. Each finding with the setting, the source read and the fix. Attack paths, evidence grades A to D, nightly hash-chain seal, WORM archive.
Threat Intel and the MITRE map
Which known attacker groups could reach your data today, from what your last scans found. Every technique is a door: open, closed, or not measured.
Insurance Posture
Upload the cyber application you signed. Each answer checked against the live tenant, drift dated, Coverage at Risk alerts. Nothing pre-filled.
Compliance, SOC 2 first
An observation window built from the records you already have. Observed and attested never mixed. Your auditor makes the call, not us.
KAM, the AI executive report
A summary for your board, investors and first enterprise customer, with the PDF technical report and the Excel action matrix. It cites its record and names what was unanswered.
Brand Defense and ticketing
Lookalike domain monitoring with takedown workflow, and findings sent to your ticketing tool or by email.
Three months free. Then decide with your own record in hand.
Approved startups run the platform free for 3 months, on up to 3 connections, with the KAM executive report and Insurance Posture included. Months 4 to 12 at the startup rate, half of list. Then list price: one monthly subscription per Scanner, month to month, no minimum, cancel in the app.
Who is eligible and what you get
Who is eligible
- Pre-seed to Series A
- Under $10M raised in total
- Under 50 employees
- Founded in the last 5 years
- Not an existing SecValley customer
- A company email domain
What you get
- Security Posture on up to 3 connections
- KAM executive report, PDF and Excel, every scan
- Insurance Posture and Compliance early access
- Help Center and email support
Why staying on matters
- The SOC 2 observation window starts at your first scan. A lapse restarts it.
- Insurance Posture drift stops being dated when scans stop.
Application received
A person reviews every application. We reply to you within 2 business days. While you wait, run your free scan.
Start a free scanStartup program FAQ
Eligibility, pricing after the free months, SOC 2, access and which platforms are covered.
Who is eligible for the SecValley startup program?
Startups from pre-seed to Series A with under $10M raised in total, under 50 employees, founded in the last 5 years, that are not already SecValley customers and apply with a company email domain. A person reviews every application and replies within 2 business days.
What do approved startups get for free?
Three months of Security Posture on up to 3 connections, the KAM executive report with the PDF technical report and the Excel action matrix on every scan, early access to Insurance Posture and Compliance, and Help Center plus email support.
What does SecValley cost after the free months?
Months 4 to 12 are billed at the startup rate, half of list price. From month 13 the list price applies: one monthly subscription per Scanner, month to month, no minimum term, cancel in the app.
Can SecValley make my startup SOC 2 compliant?
No. Compliance, in early access, builds a SOC 2 observation window from the records your scans already produce and keeps machine-observed and person-attested evidence apart. Your auditor makes the call. SecValley does not issue audit reports, opinions or certifications.
Is it safe to connect our Microsoft 365 or cloud account?
Access is read-only, certificate-based and agentless, and you can revoke it at any time. Anything the scanner cannot read is reported as unanswered, never as a pass. Connecting takes about 5 minutes.
Which platforms does the startup program cover?
Microsoft 365, Microsoft Entra ID, Microsoft Azure, AWS, Google Cloud, Google Workspace and GitHub, each evaluated against its CIS benchmark at a pinned version or a SecValley control set.
Can I use the report for a customer security questionnaire or a cyber insurance application?
Yes. Each scan produces a sealed, dated record with the setting read, the source and the fix, which you can forward to a customer, an investor or a broker. Insurance Posture checks the answers in a signed cyber insurance application against the live tenant, question by question. SecValley is not an insurance broker, agent or carrier.
Why does staying on after the free months matter?
The SOC 2 observation window starts at your first scan and a lapse restarts it. Insurance Posture drift stops being dated when scans stop. The record is only useful while it keeps growing.
Run one free scan first. Read the log. Decide.
Or book a 30-minute walkthroughRead-only, certificate-based access you can revoke. Your actual environment, not a sample. No commitment required.