Mid-market security stack

What this stack is for

Mid-market teams usually fail first on unfinished identity and email hygiene, unread alerts, and overlapping agents, not on the absence of another suite logo. Order the work before you shop: identity and email, endpoint hygiene, a shared vault and privileged paths, then only leftover detection or compliance jobs you can staff.

Paid platforms help operators. They do not invent MFA ownership, DMARC reporting, or patch discipline. Use the business security assessment and security stack builder to name company-specific gaps, then open a category page only for leftover work.

Finish free controls before paid seats

1. Enforce MFA on the identity provider, email admins, domain registrar, finance, and privileged cloud roles.
2. Publish SPF and DKIM, then start DMARC at p=none with mailboxes someone actually reads.
3. Confirm OS updates, disk encryption, and healthy built-in antivirus on managed devices.
4. Inventory shared passwords and standing admin accounts, and name a same-day revoke owner.
5. Name an owner for internet-facing assets and a critical-finding patch SLA before scanner demos.
6. Run the assessment and stack builder, then open only the category worksheet that matches leftover work.

Who this page is written for

Typical buyers already own Microsoft 365 or Google Workspace, manage laptops at scale, and face audits or board questions about coverage. The failure mode is buying another console before finishing authentication, mail authentication, and device baselines.

• Multi-site or hybrid work with a mix of managed and BYOD endpoints
• Enough seats that shared passwords and local admin sprawl create real blast radius
• Alert volume that already exceeds the people who will triage it

Decision order

Shortlist by leftover job after free controls, not by a catalog of logos.

• Identity and email first: MFA, legacy auth off, DMARC reporting, a phishing triage owner
• Endpoint hygiene next: patch, encrypt, remove standing local admin, healthy OS antivirus
• Shared vault and privileged paths before another detection logo
• Inventory leftover: vulnerability assessment before buying another scanner console
• EDR or MDR only when alerts would otherwise sit unread
• Compliance leftover: evidence owners and control mapping before buying a GRC logo

Where to look next

Use these pages after the free stack is named. Do not paste passwords, keys, exact IP lists, or vault exports into worksheets.

• Business security assessment
• Security stack builder
• Vendor shortlist worksheet
• Security budget planner
• Endpoint security
• MDR
• Identity and access management
• Business security tools

Two common mistakes

Buying five overlapping suites before naming leftover jobs: stop. Finish the free stack, then open only the category worksheet that matches unpaid work.

Taking a scanner demo before inventory owners exist: decline. Name an internet-facing asset owner and a critical-finding SLA first. A second console does not invent owners.

What goes wrong

Overlapping agents without an offboarding owner waste money. Buying MDR before MFA and backup restore drills moves noise, not risk.

What to do

Stack order before logos. Finish MFA, DMARC reporting, device hygiene, and inventory ownership first. Paid seats only for leftover work you can staff. Record the constraints in the business security checklist.