Before You Buy Managed Security, Get a Security Baseline
A security baseline is a written, tested picture of what you run, who can reach it and which controls actually work today. Buying managed security without one means paying a provider to protect an environment nobody has mapped. Get the baseline first, then choose the services, because the baseline tells you what to monitor, what to fix first and how to tell later whether the money worked.
Losses keep rising, with or without a security baseline
Businesses turn to managed security because of ransomware, compliance rules and the fact that many small firms cannot staff a security team of their own. The losses it is meant to prevent keep rising. The FBI's Internet Crime Complaint Center received 1,008,597 complaints in 2025, with $20.877 billion in reported losses, a 26% increase over 2024.
That figure is the top of a steady climb. The chart shows reported losses for each of the last five years, which have roughly tripled since 2021.
2021 to 2025. Reported losses went from 6.9B to 20.9B.
| Reported losses | |
|---|---|
| 2021 | 6.9 |
| 2022 | 10.3 |
| 2023 | 12.5 |
| 2024 | 16.6 |
| 2025 | 20.9 |
Buying coverage is not the same as being covered. One common reason is coverage bought for infrastructure nobody has inventoried, identities nobody has mapped and systems nobody can fully see.
Why security plans fail without a security baseline
Plenty of companies can show you a security plan but not a current list of their servers, cloud accounts, admin logins and internet-facing services. Plans fail because they describe the environment the company believes it has, while attackers work against the one it actually runs.
The gap shows up in familiar ways. A former contractor's account still has admin rights. A test server built three years ago still answers on the internet. A remote access tool was installed by a vendor and never removed. An expensive security tool was bought, licensed and never fully switched on. None of this is exotic. All of it is invisible until someone looks, and a security baseline is the act of looking.
What a security baseline covers
You do not need to invent a method. The NIST Cybersecurity Framework 2.0, published in February 2024 and "designed to help organizations of all sizes and sectors," includes a function called Identify, defined as "The organization's current cybersecurity risks are understood." Its first category, Asset Management, begins with maintaining inventories of hardware, software, services and systems. The framework also describes a Current Profile, which "specifies the Core outcomes that an organization is currently achieving." In plain terms, that Current Profile is your security baseline. NIST also notes that "the CSF does not prescribe how outcomes should be achieved," so the framework tells you what to record and leaves the tools to you.
- Current Profile
- The outcomes your organization is achieving today, and how far. This is the security baseline.
- Target Profile
- The outcomes you have chosen and prioritized for where you want to be, allowing for new requirements, new technology and threat trends.
- Community Profile
- A published baseline of outcomes for a sector or a shared threat, which you can use as the starting point for your own Target Profile.
- Gap analysis
- The comparison of the Current and Target Profiles that becomes a prioritized action plan.
For smaller organizations, CISA's Cross-Sector Cybersecurity Performance Goals narrow the list further. CISA says the voluntary goals "strive to help small- and medium-sized organizations kickstart their" security work by focusing on "a limited number of essential actions with high-impact security outcomes," and describes them as "a baseline set of cybersecurity practices."
How NIST says to build a security baseline and use it
NIST CSF 2.0 lays out five steps for creating and using a profile, and they map cleanly onto a baseline project:
1. Scope it
Decide what the profile covers: the whole company, or one area such as finance systems or ransomware readiness.
2. Gather the facts
Collect policies, risk priorities, the standards you follow, the tools and procedures in use, and who does which job.
3. Create the profile
Record the Current Profile, your security baseline, and use what it shows to plan the Target Profile.
4. Analyze the gaps
Compare current and target, and write a prioritized action plan such as a risk register.
5. Act and update
Work the plan, update the profile, and repeat the steps as often as needed.
Questions a security baseline should answer
- What do we actually have running, on premises and in the cloud?
- Which people and which service accounts can reach which systems, and should they?
- What is reachable from the internet that should not be?
- Where are credentials and keys stored, and who rotates them?
- Are multi-factor authentication, backups and logging switched on everywhere we think they are?
- Which of these gaps would hurt most if an attacker found them first?
Alert forwarding is not risk reduction
Managed security services tend to fall into two kinds. One is alert forwarding: a team watches your logs, opens tickets and sends you notices. The other is risk reduction: a provider that can show your attack surface got smaller after it started.
The difference starts before any tool is deployed. A provider who skips discovery installs a standard package on an environment it has not seen, monitors what the package can see, and misses what it cannot. A provider who starts from a security baseline knows which systems matter, which accounts are risky and which gaps to close first, and can measure progress against that starting point.
How to use a security baseline when you buy managed security
- Ask for discovery first. A provider should map your assets, identities and exposure before quoting a toolset.
- Ask what will be measured. Fewer internet-facing services, fewer admin accounts, full MFA coverage and tested restores are outcomes you can check.
- Ask how often the baseline is refreshed. Environments drift every month as people join, leave and add tools. A once-a-year snapshot goes stale fast.
- Keep the baseline yourself. It is your record of your business, and it should move with you if you change providers.
Where LTFI fits
A security baseline starts with a first look from the outside. LTFI's free site check gives a plain-language grade on your website's security basics, search basics and other public signals, with nothing to install. It is a useful first look, not a full audit, and a person can follow up on the findings. The inside of your environment, the accounts, identities and internal systems, still needs the full baseline described above.
LTFI itself runs on a server dedicated to your company, managed, patched and watched by Kief Studio, and rules, permissions and credentials stay with people. See what LTFI does. Our notes on using an assessment at insurance renewal and on tracking machine identities go deeper on two of the gaps.
Frequently asked questions
What is a security baseline?
It is a documented, tested snapshot of your systems, accounts, exposure and working controls at a point in time. NIST CSF 2.0 calls it a Current Profile: the outcomes an organization is achieving today. Every later decision and improvement is measured against it.
How is a security baseline different from a security plan?
A plan describes what you intend to do. A baseline records what is actually true today. Plans written without a baseline often protect an environment that no longer exists.
What is the difference between a security assessment and an audit?
An audit checks your controls against a fixed standard and produces evidence for someone else, such as a customer or regulator. An assessment that builds a security baseline records what is true today and what to fix first. NIST notes that its framework does not prescribe how outcomes should be achieved, so the baseline is yours to shape.
Where should a small business start?
With an inventory: what you run, who can log in, and what is reachable from the internet. CISA's Cross-Sector Cybersecurity Performance Goals are written to help small and medium-sized organizations start with a limited number of essential, high-impact actions.
How often should a security baseline be updated?
Continuously if you can, and at least whenever you add systems, change providers or onboard and offboard staff. NIST says the profile steps can be repeated as often as needed, and annual snapshots miss the accounts and services that appear in between.
Can a managed security provider build the baseline for us?
Yes, and a good one will insist on it before deploying tools. Make sure you receive and keep the results, so the record stays with your business.
Start with a free outside look at your website, then talk to us about the rest.
Run the free site checkMore on Industry notes
- White-Label Hosting Is Dead. White-Label Operations Is What Clients Actually WantAugust 25, 2026
- The Compliance Assessment That Pays for Itself in One Cyber Insurance RenewalAugust 12, 2026
- Vendor Lock-In: How It Happens and How to Avoid ItAugust 12, 2026
- Own the Box: What It Means to Own Your InfrastructureAugust 12, 2026