IT Security and Cybersecurity Services for Iowa Businesses
IT security protects your computers, networks, cloud services, and data from attackers. Sanctus is an independent consulting firm that finds the weaknesses in all of them before an attacker does. We test, assess, and advise, and we don't manage your IT or sell security products.
Whether you're responding to an insurance questionnaire, preparing for a vendor security assessment, or investigating after a breach scare in your industry, we have the right engagement for where you are today.
Which service fits your situation?
If you're not sure where to start, match what prompted the question to a service.
- An insurer, customer, or auditor asked about your security. Start with a security posture review or a vulnerability assessment.
- Someone asked for a penetration test, or you want proof of how far an attacker could get. See penetration testing.
- You moved systems to the cloud and never had them checked. See the cloud security review.
- You are building AI into your product, or your staff use AI tools with company data. See the AI security assessment.
- You have no security person and questions keep coming up. See security advisory.
Still unsure? Tell us what prompted the question and we'll point you to the right service, even when the answer is the less expensive one.
Security Posture Review
Starting at $3,000
Your cyber insurance renewal came with a questionnaire you couldn't finish. A customer asked about your security program and you didn't have a great answer. Sound familiar?
A Security Posture Review is the best starting point for organizations that haven't had a recent security evaluation or aren't sure where they stand. We look at how users access systems, how MFA is used, how data is backed up, how remote access works, and how cloud services are configured.
You receive a prioritized roadmap focused on practical improvements your existing team can implement, not a 200-page report that collects dust.
A documented security program can also matter legally. Iowa's HF553 gives businesses with a written cybersecurity program an affirmative defense after a breach. Read our HF553 explainer →
What we review, the frameworks we use, and what you receive →
- Access controls, MFA, and account hygiene
- Endpoint and patch management practices
- Cloud, VPN, and remote access usage
- Backup and recovery readiness
- Logging, monitoring, and alerting basics
Vulnerability Assessment
Starting at $2,500
A business in your industry got breached and you're wondering whether it could happen to you. Or your IT team says you should "do something about security" but you're not sure what.
A Vulnerability Assessment combines broad-coverage scanning with manual validation to identify missing patches, insecure services, and misconfigurations across your environment. It's ideal for ongoing security hygiene or as a precursor to deeper penetration testing.
We help you prioritize which systems to address first and provide practical guidance so your existing IT team can remediate issues efficiently.
What's included, how validation works, and how it compares to a penetration test →
Penetration Testing
$5,000 to $15,000
A vulnerability list tells you what might be wrong. A penetration test shows what an attacker could actually do with it, how far they could get, and what they could reach.
Penetration testing simulates real-world attackers. We focus on how far an attacker could get, what they could access, and what impact that would have on your business.
External Network Penetration Test
Simulated attacks against your internet-facing systems to identify exploitable vulnerabilities before real attackers discover them.
Internal Network Penetration Test
Models a compromised workstation or VPN account. We identify lateral movement paths, privilege escalation opportunities, and segmentation gaps.
Web Application Penetration Test
Manual deep-dive testing of authentication, authorization, session management, APIs, and business logic aligned with OWASP Top 10 and real-world attack patterns.
How our penetration tests work, what you receive, and what drives the price →
Cloud Security Review
Starting at $4,000
You moved to the cloud but aren't sure if it's configured securely. Default settings aren't secure settings.
A focused review of your cloud environment, such as Amazon Web Services (AWS), identifying misconfigurations and risky patterns that attackers commonly exploit.
- Identity and access management (IAM) configuration
- MFA, key usage, and access key hygiene
- Network security groups, firewalls, and segmentation
- Storage permissions and public access
- Logging, monitoring, and alerting coverage
AI Security Assessment
Contact for pricing
You are building AI into your product, or your team already uses AI tools with company data, and you aren't sure what could go wrong.
Security testing for AI chatbots, assistants, and agents, and reviews of how your organization uses AI tools.
- Prompt injection and jailbreak resistance
- Data and system prompt leakage
- Separation between users, including chat history
- Agent and tool misuse
- Which AI tools your staff use and what data goes into them
Security Advisory & Guidance
Contact for pricing
You don't have a security person on staff, but security questions keep coming up. You need someone you can call.
Ongoing, on-demand support for organizations without dedicated security staff. We act as a trusted advisor to help you make informed decisions and prioritize the right security work.
- Remediation planning and validation
- Secure configuration reviews for new systems
- Tooling and vendor selection guidance
- Basic policy and procedure recommendations
- Answers to "Is this safe?" questions as they arise
Pricing varies based on engagement scope and frequency. Typically offered after completing an initial project.
Independent security advice for small and mid-sized businesses
Your IT provider keeps your systems running. We check how well they are protected, and we have nothing to sell you beyond the assessment itself. That independence is why our findings can be shared with an insurer or customer without a conflict of interest.
Every engagement is performed by GPEN, GCIH, and GSEC certified consultants and ends with a plain-English report your team can act on.
We are based in Cedar Rapids and work with businesses across Iowa, including Iowa City, Des Moines, Davenport, and Ames, and with businesses nationwide. Much of our testing is done remotely.
IT security and cybersecurity questions
What is the difference between IT security and cybersecurity?
The terms overlap and are often used interchangeably. IT security usually means protecting your computers, networks, and cloud services. Cybersecurity is the broader term and also covers your data, your people, and the processes around them. For a small or mid-sized business the work is largely the same, so our services cover both.
Do we need a cybersecurity consultant if we already have an IT provider?
Often yes. Your IT provider keeps your systems running, and an independent consultant checks how well they are protected. We don't manage your IT or sell security products, so our findings are not shaped by what we would like to sell you next.
Which service should a small business start with?
If you have never had a security evaluation, start with a security posture review or a vulnerability assessment. They show where you stand and what to fix first. A penetration test is a better next step once the basics are in place, or when a customer or insurer specifically asks for one.
How much do your services cost?
Starting prices are listed with each service on this page. We scope every engagement and give you a fixed quote before any work begins, and advisory work is priced after a conversation about what you need.
Where do you work?
We are based in Cedar Rapids and work with businesses across Iowa and nationwide. Much of the testing can be done remotely, so you don't need to be nearby.
Ready to find out where you stand?
Tell us what's prompting the question. We'll come back with a few questions of our own, not a sales pitch.
Find Out Where You Stand