Home / 3AM Test
Would your client survive the 3AM call?
The 3AM Test turns operational readiness into six direct questions: Is anyone monitoring systems 24/7? Can you recover from ransomware? Who gets called when something breaks? When did someone last check systems? Are the security basics in place? Is anyone watching for active threats?
Pass means there is a clear, credible answer. Partial means the answer is incomplete or inconsistent. Fail means there is no dependable answer yet. Some answers require customer or MSP attestation because a domain or OAuth scan cannot directly observe every operational control.
PLAIN ENGLISH. VISIBLE GAPS. A NEXT STEP.
The scorecard makes the 3AM conversation concrete.
A scan cannot observe every operational promise. SCOUTz shows what the evidence supports, identifies what still needs attestation, and gives the MSP a defensible way to move from uncertainty to an owned action plan.
Read the evidence guide
Six questions worth asking before the call comes in
Is anyone monitoring your systems 24/7?
Clarify what is monitored, by whom, and how alerts are handled after hours.
Can you recover from ransomware?
Ask whether recovery plans, backups, ownership, and testing provide a dependable answer.
Who gets called when something breaks?
Confirm escalation paths, business contacts, and whether everyone knows their role.
When did someone last check your systems?
Establish the review cadence, scope, and evidence behind the answer.
Are the security basics in place?
Use the answer to frame a practical baseline conversation, not a generic checklist.
Is anyone watching for active threats?
Discuss whether threat awareness is assigned, documented, and actively followed.