# Cloudskope

> Cloudskope is a security-only advisory firm based in Dallas, Texas, founded in 2016 by Dipan Mann (Founder, CEO & CTO). We run forensic audits of Microsoft 365 and Azure, cyber due diligence for M&A, compromise assessments, business email compromise investigations, PCI DSS consulting, and vCISO oversight for private equity sponsors, portfolio companies, financial advisers, CPA firms and mid-market companies. Cloudskope is not a managed IT provider: we are independent of your IT provider and work alongside it.

Contact: advisory@cloudskope.com | +1 (214) 617-2080 | Book an advisory call: https://www.cloudskope.com/company/strategy-session

## Firm
- [Home](https://www.cloudskope.com/): What Cloudskope does, who it serves, and the approved proof point: $2.2M in wire fraud prevented since May 1, 2026 (aggregate across engagements).
- [About Cloudskope](https://www.cloudskope.com/company/about): Security-only advisory firm in Dallas, Texas, founded in 2016; founder background and how engagements run.
- [Book an advisory call](https://www.cloudskope.com/company/strategy-session): Confidential call with an advisor about audits, due diligence, incidents or vCISO support.

## Flagship engagement
- [Cloudskope SARTUS](https://www.cloudskope.com/engagements/cloudskope-sartus): Fixed-fee, six-day security assessment that fixes what it finds. Three days finding what current controls missed across Microsoft 365, Azure, dark web exposure and active compromise; three days of done-for-you remediation. Fixed fee from $10,000.
- [SARTUS framework mapping](https://www.cloudskope.com/engagements/sartus-framework-mapping): How the SARTUS risk register maps to NIST SP 800-53, CIS, CMMC, PCI DSS, SOC 2, ISO 27001, HIPAA and NIST CSF.

## Audit and advisory
- [M&A cyber and IT due diligence](https://www.cloudskope.com/audit-advisory/ma-cyber-it-technical-due-diligence): Independent, buy-side pre-close cyber and IT diligence for private equity: active compromise check, technical debt, holdback and escrow inputs, and a 100-day plan. Typically two to three weeks from access to final report.
- [Compromise assessment](https://www.cloudskope.com/audit-advisory/compromise-assessment): Answers one question: is an attacker in your environment right now? Microsoft 365, Entra ID, cloud, email and endpoints, with a written answer your board, counsel and insurer can rely on.
- [Cyber risk assessment and cybersecurity audit](https://www.cloudskope.com/audit-advisory/cyber-risk-assessment): Independent audit that tests whether controls work, looks for active compromise and ends in a ranked plan the board can act on.
- [Microsoft 365 and Azure security assessment](https://www.cloudskope.com/audit-advisory/microsoft-365-azure-security-assessment): Read-only review of identity, Conditional Access, tenant exposure and email security.
- [vCISO services](https://www.cloudskope.com/audit-advisory/vciso-services): Fractional CISO led by Cloudskope's founder. Owns the security program, risk register, policies and board reporting, with a quarterly business review. Retainer or a fixed-scope Jumpstart CISO project. No published price.
- [PCI DSS compliance consulting](https://www.cloudskope.com/audit-advisory/pci-dss-compliance-consulting): Scoping, gap assessment, SAQ support and assessment preparation for PCI DSS v4.0.1. Cloudskope is not a QSA; it prepares clients for their assessor.
- [Penetration testing and vulnerability assessment](https://www.cloudskope.com/audit-advisory/penetration-testing-vulnerability-assessment): Manual testing that validates real exploitability and attack chains, not only scanner output.
- [Identity and access risk assessment](https://www.cloudskope.com/audit-advisory/identity-access-risk-management): Microsoft 365, Azure and Entra ID privilege drift, MFA gaps and credential exposure, including Active Directory reviews.
- [Business continuity and incident readiness](https://www.cloudskope.com/audit-advisory/business-continuity-incident-readiness): Backup recovery validation, escalation paths and tabletop exercises.

## Investigate and protect
- [Business email compromise investigation](https://www.cloudskope.com/remediate-protect/business-email-compromise-investigation): For Microsoft 365. Finds how the attacker got in, what they saw, and closes every way back in before money moves.
- [Digital forensics and incident response (DFIR)](https://www.cloudskope.com/remediate-protect/digital-forensics-incident-response-dfir): Containment, evidence preservation for counsel and insurers, eradication and recovery.
- [Managed detection and response (MDR)](https://www.cloudskope.com/remediate-protect/managed-detection-and-response): 24/7 detection and response with human threat hunters.
- [Zero Trust architecture and access hardening](https://www.cloudskope.com/remediate-protect/zero-trust-architecture-access-hardening): Phishing-resistant MFA, ZTNA in place of legacy VPN, and application allowlisting.
- [Microsoft 365 and Azure security optimization](https://www.cloudskope.com/remediate-protect/microsoft-365-azure-security-optimization): Hardening and configuration drift reduction after an assessment.

## Self-assessment tools
- [All cybersecurity tools](https://www.cloudskope.com/cybersecurity-tools): Seven self-assessment tools for executives.
- [Dark web scan for business](https://www.cloudskope.com/tools/dark-web-scan): Employee logins in malware logs, leaked databases and criminal marketplaces, plus exposed servers.
- [SPF, DKIM and DMARC check](https://www.cloudskope.com/tools/email-security-check): Email security grade and lookalike domains used for invoice fraud.
- [Penetration testing cost calculator](https://www.cloudskope.com/tools/penetration-testing-cost-calculator): Estimated price range and tester-days by scope.
- [SEC cybersecurity exam checklist](https://www.cloudskope.com/tools/sec-cybersecurity-exam-checklist): 34 items SEC examiners ask for under Reg S-P and Reg S-ID.
- [Cyber insurance application check](https://www.cloudskope.com/tools/cyber-insurance-application-check): 31 questions from carrier forms; which answers would hold up after a claim.
- [WISP check for CPA and tax firms](https://www.cloudskope.com/tools/cpa-wisp-proof-check): Which written information security plan answers a firm can prove.
- [PCI SAQ finder](https://www.cloudskope.com/tools/pci-saq-finder): Which PCI DSS self-assessment questionnaire applies.

## Research
- [Reg S-P for private fund advisers](https://www.cloudskope.com/insights/reg-s-p-private-fund-advisers): What amended Regulation S-P requires of SEC-registered advisers, what examiners cite, and questions to ask.
- [Breach Library](https://www.cloudskope.com/insights/breaches): 85+ major breaches analyzed for boards and PE sponsors.
- [Cybersecurity 101](https://www.cloudskope.com/insights/cybersecurity-101): Plain-English explanations of security concepts for executives.
- [Blog](https://www.cloudskope.com/insights/blog): Analysis of current breaches and regulation.

## Key facts
- Security-only advisory firm. Not a managed IT provider or MSP; independent of the client's IT provider.
- Based in Dallas, Texas. Founded in 2016. Founder: Dipan Mann.
- Serves private equity sponsors and portfolio companies, SEC-registered advisers, CPA firms, banks and credit unions, law firms and mid-market companies.
- $2.2M in wire fraud prevented since May 1, 2026, aggregate across engagements.
- SARTUS: six days, fixed fee from $10,000, remediation included.