Everything you need to get started, run assessments, understand your results, and get the most out of the platform.
A quick overview of what SecureGap does, who it's for, and how the assessment engine works.
→Step-by-step: signing up, setting up your organization profile, inviting team members.
→Choosing between Security Layer Assessment and Vendor Evaluation. What to expect from the flow.
→How to read your risk map, what findings mean, and how to use your remediation roadmap.
→SecureGap is an AI-powered security assessment platform that helps mid-market organizations identify gaps across eight security layers and generate prioritized remediation roadmaps — without sitting through a six-week consulting engagement.
Sign up takes about two minutes: an email, an organization profile, and you're in. This guide walks through each step and explains what each field is used for downstream.
Pick an assessment type, answer context-aware questions, and watch the gap engine generate findings layer by layer. Most teams finish their first run in under an hour.
Your results come in three views — the risk map, the findings list, and the remediation roadmap. Each one answers a different question; this guide explains when to use which.
The flagship assessment. Covers all eight layers with adaptive questioning that branches based on your environment profile and previous answers.
A focused assessment for evaluating third-party vendors. Same engine, scoped to vendor-specific risk surfaces.
A 10-minute snapshot for teams that want a fast read on where they stand before committing to a full assessment.
The outermost layer — firewalls, network segmentation, ingress/egress controls, and the structural decisions that decide what touches your environment in the first place.
Who can do what, with what credentials, under what conditions. Identity is where most real-world breaches start; this layer treats it that way.
Devices are where work happens — and where most malware lands. This layer covers EDR, hardening baselines, patching cadence, and BYOD posture.
The code you ship and the dependencies you pull in. SAST, DAST, SBOM hygiene, and secret scanning all live here.
Where sensitive data lives, who touches it, and what happens to it at rest, in transit, and in use. Classification, encryption, DLP, and lifecycle.
IAM in the cloud, configuration drift, exposed buckets, IaC posture, and the shared-responsibility lines that decide what's actually yours to fix.
Telemetry coverage, alert quality, runbook readiness, and the difference between having a SIEM and being able to use one in a real incident.
Policy maturity, training cadence, role clarity, and the human side of security — usually the layer with the highest leverage and the lowest investment.
The risk map is a heatmap of all eight layers crossed with severity. This guide explains what each cell means and how to read the patterns that show up most often.
Critical, High, Medium, Low — and why SecureGap weights them the way it does. Severity isn't just impact; it's impact crossed with likelihood and dependency.
Findings get grouped into initiatives, ordered by dependency, and slotted into phases. Here's the logic the planner uses to decide what comes first.
An initiative bundles related findings into a single piece of work. This guide covers editing, splitting, merging, and assigning owners.
Push initiatives out to your tracker so the work happens where work already lives. Native links for Linear, Jira, GitHub Projects, and Asana.
Profile, organization details, security settings, and notification preferences — all in one place.
Inviting people, assigning roles, and understanding how seats are counted across your subscription.
Plans, billing cadence, invoices, payment methods, and how mid-cycle changes are handled.
How to cancel, what happens to your data, the 30-day retention window, and how to request immediate deletion.
Short answers to the questions we get most often — about pricing, data, the engine, and the trial.
We answer within one business day. No ticket queue, no auto-responder.