Client outcomes
Confidence, backed
by measured progress.
Four real engagements. The names are held back until the clients say yes to using them, but every number and quote below is real, not rounded up for the page.
The before and after
Progress you can see.
Each comparison shows the initial assessment and the most recent report.
Only the two measured points are shown. Nothing is plotted between them, because nothing was measured between them.
| Metric | Before | After | Reference |
|---|---|---|---|
| Nonprofit security score | 63 | 80 | |
| Healthcare credentialing security score | 24 | 88 | industry avg 74 |
| HIPAA-aligned control coverage | 25% | 76% |
Nonprofit / Managed security
A nonprofit’s estimated exposure, reduced by 29%
A regional nonprofit, mid-size. Anonymized pending permission.
Before
Security score of 63 out of 100. Estimated financial exposure per incident: $14,000.
During
Full managed security in place: monitoring, email and endpoint protection, backups tested, policies written.
After
Score up to 80 out of 100. Exposure per incident down to $10,000. 1,261 email threats blocked in a single quarter. A critical ransomware alert on August 3 auto-blocked and fully investigated the same day, before it became a business-disrupting event. A fraudulent bot payment attempt through their accounting software caught and contained with zero impact to their bank account.
“I appreciate everything you do. It's worth it. We're going to continue.”
Healthcare / Featured engagement
A stronger foundation for sensitive data.
HIPAA-aligned control coverage improved from 25% to 76%; security score rose from 24 to 88 over a year of managed security.
A medical credentialing company. Anonymized, per the confidentiality terms of the engagement.
Before
Protected health information handled on personal email accounts instead of a company-managed domain. No documented HIPAA safeguards. A security score of 24 out of 100.
During
A year of managed security: migrated onto a managed email domain, multi-factor authentication and encryption enforced everywhere patient data lives, company-wide security training, and the HIPAA policy set they did not have, written from scratch.
After
HIPAA-aligned control coverage from 25% to 76%. Security score from 24 to 88, against a 74 industry average. 245 security events managed in the fourth quarter alone, including 42 threats blocked and 15 phishing emails stopped before reaching an inbox. Estimated breakout time, the window to contain an attacker, grew from 20 minutes to 156. Training completion and safe-user rate: 100%.
“Castile came in, explained everything in clear terms, and took full ownership of our cybersecurity needs. Now I don't even have to think about it; I know we're protected.”
Metrics reflect Castile's internal tools and scoring methodology. Not a legal determination of HIPAA compliance.
IT services / Partner program
Cybersecurity revenue up 3.6x in twelve months
An Idaho Falls IT provider. Anonymized pending permission, the same partner behind the proof table on the Partners page. Figure verified directly from twelve months of paid billing records.
Before
HIPAA-covered clients, a fast-changing threat landscape, and no in-house security bench of their own to answer questions with.
During
Partnered with Castile under the white-label program. Wholesale billing started small, covering the first slice of their client base, with free branded scans opening the conversation on prospect calls.
After
Twelve months later, wholesale billing was up 3.6x as more of their clients came onto Castile services, a number that does not include whatever they charge on top. 42 clients placed in that time. A 10 out of 10 on "would you recommend us," and nothing reported in their own written review where they had to cover a gap themselves.
“Even if things were missed or delayed, as long as there is good communication we are happy.”
Defense contractor / CMMC readiness
A score, a scope, and a camera unplugged the same week
A defense contractor. Anonymized, the same client behind the proof section on the CMMC page.
Before
No clear read on where they actually stood on CMMC, or what an assessor would find if one looked today.
During
A two-to-four-week assessment: a 53 out of 100 score, an SPRS estimate of negative 26, over 1,000 files containing controlled information found sitting exposed, and a phishing test that showed exactly who needed training. One finding led to an immediate fix: a camera on their network already flagged as a supply-chain risk under federal rules, unplugged the same week.
After
A roadmap broken into what to fix in the first week, the first month, and the first 60 days, so the size of the problem never felt like a wall.
“It wasn't as bad as I expected, but it was still bad, and knowing exactly where we stood was worth it.”