MSP Auditor — a security check-up for nonprofits and their MSPs
A zero-setup, privacy-first security auditor that lets a nonprofit verify, in about 15 minutes, whether its Managed Service Provider is actually protecting it. It then writes the help desk tickets and the board briefing for them.
Built by Surzano R. Solomon.
▶ Live demo: msp-auditor.vercel.app
Next.js 15 (App Router) · TypeScript · Tailwind CSS 4 · Lucide · Node dns.promises · DNS-over-HTTPS · Vercel / GitHub Pages
Does it work?
- Domain checks: on 25 well-known nonprofit domains, the live scanner agreed with independent DNS lookups and direct header checks on 153 of 153 comparisons (SPF, DMARC and five security headers). Sites that block automated requests are left ungraded rather than failed. Full results:
validation/domain-results.md.
- User exports: 133 automated tests, including 27 built from the shapes of real Microsoft 365, Entra and Google Workspace exports, Excel re-saves, damaged files, and an admin center export combined with Entra's MFA report.
- Answer-key checks:
npm run validate:tenant compares the identity audit with a hand-written answer key for a test tenant. See validation/README.md to run all three.
1. The Problem: The Nonprofit "MSP Blind Spot"
Most small nonprofits outsource IT to a Managed Service Provider and assume that means "cybersecurity is handled." In practice, baseline MSP contracts are written for uptime (printers work, laptops get imaged, email flows), not for security outcomes. In assessments, the same gaps come up again and again:
| What leadership assumes | What we usually find |
|---|
| "Our email is protected." | DMARC stuck at p=none (monitor-only), SPF ~all. Anyone can send email as the Executive Director. |
| "Everyone has MFA." | 10–20% of accounts exempt, often a board member and at least one Global Admin. |
| "Ex-staff were offboarded." | Former employees still enabled months later, still holding paid licenses. |
| "The MSP has strong controls." | No help-desk caller verification, no tested backup restore, no weekend incident call tree. |
The root problem is vocabulary and leverage. Executive Directors and boards don't know what to ask for, so they can't hold the MSP accountable. This tool closes that gap. It verifies the controls with evidence, explains each finding in plain English, and produces the exact technical request to send to the MSP.
2. What It Does
| Tab | Module | Output |
|---|
| 1 | Domain & Website Scanner: live SPF (with recursive DNS-lookup counting), DMARC policy, DKIM selector probing, HTTPS redirect, and 5 HTTP security headers | A–F grade, pass/warn/fail cards, Plain-English ⇄ Technical toggle |
| 2 | Identity & License Hygiene Auditor: drag-and-drop Microsoft 365 / Entra ID or Google Workspace user export | MFA coverage %, stale accounts, admin sprawl, annual license waste in $, flagged-accounts table |
| 3 | 10-Question MSP Report Card: Yes / Partial / No scoring with "Why this matters" tooltips | MSP accountability grade + the exact "What to ask your MSP" script for every gap |
| 4 | Action Plan & Ticket Generator | 3 copy-paste / mailto: MSP help desk tickets with the exact DNS records, header configs, and usernames, plus a Board-Ready One-Pager (Print / Save as PDF) |
Presentation mode: the ⚡ Load Full Presentation Demo button fills all four tabs with the synthetic Hope Valley Community Services case study (24 staff, managed by "Apex IT MSP"). Live domain scans from the audience still work. If the room's Wi-Fi blocks DNS, the Simulated Demo Domain button gives fully offline results. Deep link: /?demo=1&tab=action&view=board.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
