Turn a domain into a scoped first project
Independent IT consultants sell projects, not seats. A Hookgap report gives you a specific, explainable problem to open with, and a list of fixed-price fixes to quote.
Where it fits in a consultant's week
- Before a discovery call. Check the prospect's domain the day before. You walk in knowing whether their email can be spoofed, when their certificate renews and who holds their domain.
- After a referral. An accountant or web designer passes on a name. Send a short note with the report link, so the first contact is useful rather than a sales pitch.
- At renewal time. Re-check existing clients each quarter, or add them to the watchlist, and show what has improved since you started.
Projects that come straight out of a report
- Email authentication rollout: publish DMARC with reporting, fix SPF, enable DKIM for every sender, then move to enforcement. Usually a few weeks of elapsed time and a few hours of work. See SPF, DKIM and DMARC explained.
- Encrypted mail delivery: MTA-STS and TLS reporting, often under an hour. Check the current state with the free MTA-STS checker.
- Website hardening: HTTPS redirects, HSTS and the other security headers, mixed content fixes. See security headers explained.
- Domain hygiene: registrar lock, auto-renew, two-factor on the registrar account, DNSSEC and CAA. See the domain and DNS security checklist.
Why a report works better than a pitch
Business owners do not buy "IT security". They buy a fix for a problem they now understand. The report states each gap in one sentence, explains why it matters to the business, and rates the effort to fix it, so the conversation moves straight to "how much and when". On paid plans it carries your name, not ours.
What it does not do
Hookgap reads public data only. It is not a penetration test or a vulnerability scan, and it does not look inside the network. That makes it safe to run before anyone has signed anything, and it is why the findings are framed as gaps and opportunities rather than proof of a problem.
Frequently asked questions
Is Hookgap only for MSPs?
No. Anyone who sells IT or security work to small businesses can use it: independent consultants, fractional IT managers, web agencies that host email, and managed service providers.
Can I use the report as a paid audit?
You can include it in a paid assessment, but say clearly that it covers public, external settings only. Many consultants use the free report to win the meeting and charge for the internal review that follows.
Which plan suits a solo consultant?
Solo: 150 branded reports a month, bulk checks of 50 domains, 50 watched domains and alerts in Slack, Teams or Discord, for $39 a month.
Related guides
passive security assessment
Passive security assessments: what you can check before a prospect says yesWhere the line sits between reading public data and testing someone's systems, and what you learn from staying on the right side of it.
explain DMARC to clients
How to explain DMARC to a business owner in two minutesA short script, an analogy that lands, and straight answers to the four questions owners always ask.
MSP cold email templates
MSP cold email templates that open with a real security gapFive short templates, one per common gap, plus the rules that make them work and the mistakes that get them ignored.
Check the first prospect on your list.
Three free checks a day without an account. Sign in to brand reports, save them and watch domains weekly.
Get started