General Shield
Cybersecurity by General Federal Industries
How General Shield earns trust
We sell security checks. That means our real product is trust — so this page puts everything in the open: the law every engagement runs under, exactly what we check, the rules we sign before any work, and a plain list of the claims we refuse to make.
The Authorization-First Law
Nothing runs on trust alone — it runs on a signature.
Signed authorization before any active scanning. A named owner or officer of the business signs a one-page authorization naming the exact domains and systems covered. No signature, no scan — not even a "quick look."
Client-owned systems only. We check only systems the signer owns or is formally responsible for. Never a competitor's site, never a customer's site, never "a site my client uses."
Non-intrusive methods only. Public response headers, public DNS records, certificate handshakes, and normal page fetches — the same things any browser sees. No exploitation, no password attacks, no denial-of-service, no social engineering, ever.
The client's report belongs to the client. Findings are delivered only to the signer, are never sold or shared, and are never used in marketing without separate written permission.
Scheduling and safety. Deep scans run at an agreed time, with a named contact on the client side, and stop immediately if asked.
What We Check — Our Methodology, in the Open
No secret sauce. A General Shield check is detect-and-report, using only what a visitor's browser, a mail server, or a standard network tool can already see:
Security headers audit — the protective settings the site sends to browsers: content security policy, HTTPS enforcement, clickjacking and content-type protections, referrer and permissions policies.
Encryption (TLS) check — certificate validity, expiry and name match, which protocol versions the site accepts, and whether plain HTTP redirects to HTTPS.
Cookie safety flags — whether the cookies the site sets carry the standard Secure, HttpOnly, and SameSite flags.
Service check — plain connection attempts to a small set of standard ports (web, mail, remote-login, database, alternate-web) on the named hosts only, recording which ones answer and any banner the server itself offers. We send no commands to those services.
Email protection records — the domain's public SPF, DMARC, and DKIM records: whether a stranger could convincingly pretend to email as you.
Version disclosures — where the site announces exact software versions, we note it and point to the vendor's current advisories. We do not test whether any specific known flaw is present.
Technology fingerprint notes — what the site publicly reveals about the software it runs, for your awareness.
Every finding in a report is written the same way: a severity, what we found, what it means, and how to fix it — concrete enough to hand to a web developer or hosting provider.
The Rules Are in Writing — and Signed Before Any Work
Every engagement runs under a written Rules of Engagement, signed alongside the authorization. In summary:
Named systems only. Only the systems listed in the agreement are checked. Subdomains and third-party systems are out unless they are listed too.
An agreed testing window. Checks run on the dates and hours written down — outside the window, nothing runs.
A never list with no exceptions. No accessing or copying your data. No password attacks of any kind. No exploits or payloads. No denial-of-service or load testing. No social engineering. No changes to anything. No physical access attempts.
Stop conditions. You can stop a check with one call or email, at any time, for any reason. We also stop on our own if a system looks unstable, if we encounter data we were not meant to see, or if anything unexpected happens — and we resume only with your written OK.
Critical means a phone call. If a check turns up something actively dangerous — a database answering the whole internet, private data publicly exposed — we stop testing that system and call you the same day, in plain English, before anything else. We do not dig deeper to "see how bad it is."
The full rules are signed before any work. There is no version of a General Shield engagement that starts without them.
See a Real Report Before You Decide
A sample report exists — from a real run of our own engine against our own platform, findings and all — and it is available on request. Read exactly what a report looks like, how findings are worded, and what a fix list contains, before you ever sign anything. Ask us through the contact links on the home page.
What We Never Claim
Security companies are easy to start and hard to check. So here is what General Shield will not say — stated proudly, because honesty is the product:
We never call anything "unhackable." A clean grade means the outside doors and windows we can see are in good shape. No honest firm can promise a system cannot be hacked, and we will not pretend otherwise.
We offer no breach warranty. Some large firms advertise multi-million-dollar warranties; read theirs closely and you will find bundles, multi-year terms, and strict eligibility conditions underneath. We do not have underwriting behind us, so we do not sell the promise. What we stand behind is the accuracy of our report and a re-check after your fixes.
We do not claim a 24/7 security operations center. We are a small, named team running scheduled checks with same-day calls on critical findings. If that ever changes, this page will say so — after it is true, not before.
We display no certifications we do not hold. Industry certifications such as SOC 2 and ISO 27001 are earned through audits over months. We are a new firm and do not hold them yet, so no badges appear on this site. When one is earned, it will appear here with its date.
We never call a scan a penetration test. Our checks look from the outside and report. Penetration testing — a human actively trying to get in — is a different, deeper engagement that we do not sell today, and we will not dress our service up in its name.
No borrowed logos, no invented clients. When clients let us tell their story, their names will appear here with their permission. Until then, our proof is below: our own grades.
Our Own House, Graded in Public
Before we offered this to anyone, we pointed the machine at ourselves — and published what it said.
C → D
Our own platform: GeneralOS
Our CRM platform graded C on the first version of the engine. When the stronger second version learned to map open ports and services, it found more surface on our own house — and the grade dropped to D. Nobody here softened the number.
F
Our own public website
Our public company website scored lower still — an F — partly because its hosting platform does not let owners set the protections our scanner looks for. We say so plainly, because that is the job.
Our machine grades us harder as it gets smarter. It will do the same for you — honestly.
Our Transparency Commitments
Findings go only to the signer. Your report is delivered to the person who signed the authorization — nobody else.
Your report is never marketing material. We will not sell it, share it, or quote from it without your separate written permission.
Working notes have a lifetime. Notes from a check are kept only for the period written into your engagement paperwork, then deleted — sooner if you ask.
Critical findings are called in the same day. Not buried in a report you might read next week.
Our own results stay public. Our grades are on this site whether they flatter us or not — including when a stronger engine lowers them.
This page stays current. If a commitment here stops being true, the page changes — before the next client signs, not after.
