First-30-days discovery
You signed the client, ran onboarding, installed the agents and moved on. Six months later an incident turns up an admin account, a forgotten server or a remote access tool the previous provider installed and never mentioned. It was there on day one. Nobody looked, because the checklist only covered what you were installing.
Onboarding is the one moment you have permission to look everywhere and nobody has started assuming things are fine. After it, the client expects you to know their environment, and gaps you missed quietly become gaps you own.
Gather first: your current onboarding checklist and the tools you deploy.
The prompt:
Build a first-30-days security discovery checklist for new clients, so we find what the previous provider left behind before it becomes our problem.
What experienced onboarding engineers know:
Onboarding checklists usually cover what we install, not what was already there. The admin account, the forgotten server and the old remote access tool were there on day one.
Onboarding is the one moment we have permission to look everywhere. Six months later the client expects us to know their environment, and missed gaps become gaps we own.
Outgoing providers hand over what they remember, not what exists.
Our current onboarding checklist: [paste]
The tools we deploy at onboarding: [details]
What the outgoing provider usually hands over: [details]
Do this:
Write a discovery list covering admin and service accounts, remote access tools, internet-facing services, backups, licensing, and any software we did not install.
Design a findings report that rates each item Critical, High, Medium or Low, with the reason for the rating.
Draft the summary page for the client, covering the first three fixes, their dates and who owns each.
Mark which checks need client cooperation, and which we are able to run ourselves from day one.