Already have an MSP? Good. We complement them, we don't replace them.
June 3, 2026
Reg S-P is in force.
The SEC's compliance deadline for smaller advisers has passed. Examiners are now asking for evidence, not plans.
August 2026
Attacks are targeting funds.
Coordinated AI-driven vishing hit hedge funds this August, sophisticated enough that FINRA activated its Fusion Center.
Consolidated
The specialists left.
Firms trusted specialist security providers and watched them get absorbed into generalist platforms. Your risk profile didn't generalize with them.
Keep your MSP. We do everything they don't.
Your MSPThem
Keeps the lights on
Helpdesk
Devices and endpoints
Email and identity
Uptime and infrastructure
Delta DeskUs
Does the work outside their lane
Independent security testing
Reg S-P compliance and evidence
Dark web and supply-chain monitoring
Exam preparation
Rehearsed incident response
Prioritized remediation roadmap
Your MSP keeps the lights on: helpdesk, devices, email, uptime. We do the work that sits outside their lane. We hand your MSP a prioritized remediation roadmap; they execute it. No turf war, no rip-and-replace.
What we do
Five capabilities, one focus: keeping asset managers secure, compliant, and ready to prove both.
01Assess & Test
Independent security audits, penetration testing, and cloud security reviews. CISSP and OSCP led, with a prioritized remediation roadmap your team or MSP can execute.
02Comply & Prove
The SEC's amended Regulation S-P requires a documented incident response program, 30-day customer breach notification, vendor oversight, and five years of records. We build it and keep it exam-ready.
i
Policies and IR program
Written policies and an incident response program, mapped to what examiners ask for first.
ii
Vendor oversight
Tracking for every service provider that touches customer information.
iii
30-day notification
A breach-notification workflow rehearsed before you ever need it.
iv
Maintained evidence pack
Policies, vendor records, notification timelines, and annual reviews. Exportable on demand for exams and allocator due diligence.
03Monitor
Continuous watch over the places risk actually enters a firm.
i
Managed detection
Business-hours or 24/7 coverage, depending on tier.
ii
Dark web monitoring
Credentials tied to your employees, your clients, or your firm.
iii
Patch management
Priority alerts on high-risk vulnerabilities.
iv
Software supply chain
Monitoring across NuGet, Node.js, and pip for firms running custom tools.
04AI Security & Readiness
Your firm is adopting AI whether you've decided to or not. Your staff, your vendors, and your attackers already have. This August's coordinated AI-vishing campaign against hedge funds made that plain. We cover the full path.
AI readiness
An acceptable-use policy, data-handling rules, and staff training that covers AI-driven social engineering: voice cloning, deepfakes, and vishing.
AI tool and vendor evaluation
Due diligence on the AI products entering your stack, and what firm or customer data they can see, before your compliance exam asks.
AI security testing
For firms building with AI: prompt injection, agent privilege abuse, data exfiltration through AI tooling, and red-team exercises against your actual stack.
05Advise
A named security officer without the full-time cost, from fractional advisory for emerging managers to quarterly board and investor-facing reporting for established firms. DDQ preparation and allocator evidence packages included at every level.
Packages
One-time setup to get you compliant, a monthly retainer to keep you there. Every tier is Reg S-P aligned.
Essentials
Solo and small RIAs, emerging managers, first formal program.
Assessment and gap analysis
Written policies and incident response program
Baseline hardening and MFA
Quarterly scanning and high-risk patch alerts
Vendor oversight for key providers
Exam-ready evidence pack
Professional
Growing managers and multi-family offices with vendors and exam scrutiny.
Everything in Essentials, plus
Annual penetration testing
Business-hours managed detection
Dark web monitoring
Full patch management
Expanded vendor oversight
Annual tabletop exercise
Named security advisor
Enterprise
Established managers, quant funds, larger family offices.
Everything in Professional, plus
24/7 managed detection
Semi-annual external and annual internal penetration testing
Software supply-chain monitoring
Unlimited vendor oversight
Priority incident response
Quarterly board and investor reporting
Essentials
Professional
Enterprise
One-time setup
$8,500
$18,000
$35,000
Monthly retainer
$1,500
$4,000
$8,500
Minimum term
12 months
12 months
12 months
Essentials
One-time setup
$8,500
Monthly retainer
$1,500
Minimum term
12 months
Professional
One-time setup
$18,000
Monthly retainer
$4,000
Minimum term
12 months
Enterprise
One-time setup
$35,000
Monthly retainer
$8,500
Minimum term
12 months
Penetration tests, breach forensics, and specialized add-ons scoped separately. Multi-year and multi-entity discounts available.
Just need Reg S-P? Start with the Compliance Workspace.
Vendor oversight, the 30-day notification workflow, and a maintained evidence pack, without the full security program.
Setup
$1,500
Monthly
$299
Fully credited toward any package within six months.
Your website and your cloud tenant are the two parts of your firm that an attacker can study without ever touching your staff. Each service below answers a different question. Take one. Take all three.
Every service is a one-time fee, fixed as soon as we scope it. No retainer. No minimum term. Each report is written so that you can hand it to an examiner or to an allocator.
We fix critical findings during the engagement. You do not wait for a roadmap.
Exposure Review
What can an attacker find without touching us?
We work from outside only. No credentials, and no contact with your staff. We collect with automation, then a person reviews every result.
Website
Subdomain, DNS, and forgotten asset discovery
Technology fingerprint and known vulnerability match
TLS, security headers, and exposed files
SPF, DKIM, DMARC, and lookalike domains
Cloud
Public storage containers and open services
Tenant identity settings, as seen from outside
Leaked credentials tied to your domain
From $3,500. One week.
Configuration Review
Are our own settings holding?
We work from inside, with read only access. We compare your live settings against the benchmark and against how your firm actually operates. We do not exploit anything.
Website
Hosting and application configuration
Client portal sign-in settings
Session and cookie handling
Third party scripts, and what data each one can see
Cloud
Tenant settings against the CIS benchmark
Conditional access and privileged roles
Storage, key, and secret handling
Log collection and retention
From $6,500. Two weeks.
Penetration Test
What happens when someone actually tries?
Manual, adversarial testing, led by a CISSP and OSCP practitioner. We show you the full attack path, not a list of weaknesses.
Website
Manual testing, to the OWASP Web Security Testing Guide
Business logic and privilege escalation
Chained vulnerability testing
Cloud
Attack path from one taken account to your data
Escape test from the web application into the tenant
Report
Formal report, attestation letter, and a free retest
From $11,500. Three weeks.
Fees depend on the number of sites, client portals, and cloud tenants in scope. We give you a fixed number before you sign.
All three together: from $18,500. We remove the duplicate discovery work and pass on the saving.
Need hands on the fix? Remediation support is $2,500 per 10 hour block, or we brief your MSP at no charge.
Want this run every quarter instead of once? That is the Packages section.
We work in scoped engagements with defined deliverables: an audit, a program buildout, a monitored retainer. You always know exactly what you're getting and what it costs. No open-ended consulting. And we work alongside your existing MSP or IT team, not against them: they get a clear roadmap, you get one accountable security partner.
We never grade our own homework.
Where we operate your environment, independent third-party testing is built into the engagement at cost. Your allocators are told to demand independent evidence over self-assessment. We agree with them.
Recent engagement
Recent engagement results
$3B+
SEC-registered family office
72-point
security review
20
findings surfaced
2 critical
remediated on day one
Since smoothly transitioning to Delta Desk from another Third-Party system, we've gained a seamless, scalable cloud-based solution and a real improvement in our cybersecurity posture. But the biggest differentiator has been the personal service and total commitment to our success. Moving to Delta Desk has been a big win for our firm.
Delta Desk pairs two people who usually sit on opposite sides of the table: a former hedge-fund CTO who spent years building the trading and operations infrastructure asset managers run on, and an offensive-security practitioner (CISSP, OSCP) who tests it the way an attacker would.
That pairing is the firm. We understand your systems, your regulators, and your allocators' due-diligence questionnaires because we've been on the receiving end of all three. And while most of the industry's security providers have consolidated into private-equity platforms, we're founder-controlled. The people you meet are the people who do the work.
A 30-minute readiness call covers your posture against Reg S-P and the SEC's examination priorities. You'll leave with a clear view of your gaps, whether or not you become a client.
