Field tool

Agency security scorecard

Fifteen controls, what each one actually prevents, and where you stand. Answer for your current agency, one you are evaluating, or your own marketing team.

15 controls · About 5 minutes · No sign-up · Nothing leaves your browser

Use the “Print or save as PDF” button on the page to save your results.

0/30 Not started

0 of 15 answered

01

Access

If you fix nothing else, fix access. It is the layer that makes every other control meaningful.

—
  • 01

    Phishing-resistant MFA everywhere

    One stolen password is no longer enough to get in. The highest-value control here.

    Phishing-resistant MFA everywhere
  • 02

    Individual named accounts

    Shared logins destroy attribution, offboarding and MFA at once.

    Individual named accounts
  • 03

    Least-privilege roles

    Caps the blast radius of any single compromised account.

    Least-privilege roles
  • 04

    Documented offboarding, 24 hours or less

    Departed staff keep access by default unless a process removes it.

    Documented offboarding, 24 hours or less
  • 05

    Access inventory, reviewed quarterly

    You cannot secure systems you have never written down.

    Access inventory, reviewed quarterly
  • 06

    Password manager, org-wide

    Ends password reuse, and retires the shared spreadsheet passwords usually live in.

    Password manager, org-wide
02

Data

Marketing data gets treated as a working asset rather than a governed one. Every copy is real, indefinite exposure.

—
  • 07

    Company owns every account

    Protects your data and your exit. Cheap now, expensive later.

    Company owns every account
  • 08

    Data minimization and retention

    Shrinks the volume and lifetime of what a breach can expose.

    Data minimization and retention
  • 09

    Written AI usage policy

    Decides what may be pasted into tools before someone decides for you.

    Written AI usage policy
03

Infrastructure

The website is production infrastructure that happens to serve pages, and the access around it reaches further than most teams assume.

—
  • 10

    DNS locked, MFA, named owner

    Highest-leverage records you own: mail, traffic, certificates.

    DNS locked, MFA, named owner
  • 11

    Tag manager publish restricted

    Publish rights are arbitrary code execution on every page.

    Tag manager publish restricted
  • 12

    Off-host, restore-tested backups

    An untested backup is a hope. A writable one does not count as a backup.

    Off-host, restore-tested backups
  • 13

    Scoped, rotated API keys

    Limits what a leaked key reaches and how long it works.

    Scoped, rotated API keys
04

Money & identity

Advertising platforms spend money directly, and are governed with less rigor than a corporate card while frequently moving more of it.

—
  • 14

    OAuth and connected-app review

    Tokens survive password changes and never appear in your user list.

    OAuth and connected-app review
  • 15

    Joint incident response plan

    Determines whether hour one is contained or chaotic.

    Joint incident response plan

Results

Answer all fifteen controls. Your score, a breakdown by section and a prioritized list of gaps will appear here.

Results

0 out of 30

By section

    Where to start

    Ordered by the leverage rating each control carries in the guide, so the first item closes the most exposure for the least work.

      Bands are Seismic's reading of the fifteen controls, not an industry certification: 27 and above strong, 20 to 26 reasonable, 12 to 19 exposed, 11 and below critical.

      The full guide

      Every control here gets a full explanation in the field guide

      The Marketing Attack Surface covers what each control prevents, how to put it in place, and the ten questions to ask a marketing partner before you sign. Sixteen pages, produced with Cytek.

      Get the guide
      Cover of The Marketing Attack Surface, Issue 01 of the Seismic Digital Editorial Field Guide

      Your results

      Save your results as a PDF

      Tell us where to reach you and your results unlock as a printable PDF.

      Seismic Digital will use these details to follow up about marketing security and occasional related material. Unsubscribe at any time. See our privacy policy.

      Ready

      Your results are unlocked

      Choose Save as PDF as the destination in the print dialog.

      Save results as PDF