For businesses with 1–20 people
You don't have an IT department. You still have risk.
A security assessment built for the dental office, the law practice, the accounting firm, the contractor, the nonprofit — businesses where the owner is also the IT department, and nobody has ever looked at this properly. One flat fee, no access to your systems, and a report you can actually use.
Most assessments for businesses your size start at $3,000 and assume you have infrastructure to scan. This one is $995 and assumes you have a laptop, a website, and a reasonable amount of worry.
Why owners usually call
An insurer asked
Your cyber liability application has questions you can't honestly answer, or your renewal now requires attestations about controls you've never reviewed.
A client asked
A bigger customer sent a security questionnaire, and you'd like to answer it accurately rather than optimistically.
Something nearly happened
A fake invoice, an email that looked like it came from you, a staff member who clicked something. Nothing broke — this time.
Someone left
An employee moved on and you're not confident every account they touched got turned off.
A peer got hit
Another practice in town had ransomware, you heard what it cost, and you'd rather find out where you stand before it's your turn.
You just want to know
No incident, no deadline, no pressure — you'd simply like a clear answer to "how bad is it?" from someone with no product to sell you.
What gets assessed
Two sources of truth: what I can verify independently from public information, and what you tell me in a working session. The report always says which is which.
Verified independently
Done before we talk, using only your domain name. Nothing required from you.
Email spoofing protection
Whether your domain has SPF, DKIM, and DMARC configured correctly. Without them, anyone can send email that appears to come from your business — which is how invoice fraud starts. This is the single most common serious gap I find.
Breach and infostealer exposure
Whether credentials tied to your domain appear in known breaches or in infostealer malware data. The second one matters more: it means a device was actually compromised, not just that an old site leaked.
Internet-exposed services
What's reachable from the outside that shouldn't be — remote desktop, file sharing, database ports, router and device admin panels, forgotten test sites. These are the doors ransomware walks through.
Website and platform security
Certificate validity, encryption configuration, security headers, and platform and plugin versions against known vulnerabilities. WordPress sites get a closer look, because they usually need one.
Domain and DNS health
Registration expiry, spam blocklist status, unexpected DNS records, forgotten subdomains, and whether any of them could be hijacked. Losing control of your domain is a business-ending event.
Public exposure
What an attacker can learn about your business from public sources before they ever touch it — staff names and roles, email address patterns, vendors, and the operational details people post without thinking.
Covered in the working session
A 90-minute conversation about how your business actually runs. No screen sharing, no settings to navigate, no scripts to run — just questions, answered as best you can.
Accounts and access
Who has admin rights, whether two-factor is on, how new staff get set up, what happens when someone leaves, and which logins are shared. Offboarding is where small businesses leak most.
Devices and updates
What computers and phones touch business data, whether they're company-owned, how updates happen, what protection is installed, and what happened to the old machines.
Network and remote work
Guest Wi-Fi separation, router configuration and age, how remote staff connect, and what else is sitting on the same network as your business computers.
Data and backups
Where your sensitive information actually lives, whether backups run automatically, whether anyone has ever tested a restore, and whether client data has drifted into personal accounts.
Staff practices
Training, phishing near-misses, how passwords get shared, whether people feel safe reporting a mistake quickly. Culture is a control, and it's usually the cheapest one to improve.
Regulatory context
Whether you handle health information, payment card data, or government IDs, and what your client contracts and insurance policy actually require of you. This shapes how severely I rate everything else.
What you get
- A written report, usually 12–20 pages
- Every finding rated high, medium, or low in the context of your business
- A "top five, do these first" section
- Plain-language explanation of each finding and why it matters to you specifically
- A concrete next step for every single finding
- An honest list of what you're already doing right
- A 60-minute walkthrough call
- A report you own and can forward to any vendor or insurer
What this isn't
- Not a penetration test — I don't try to break in
- Not remediation — I diagnose, you decide what to fix
- Not ongoing monitoring or managed IT
- Not a compliance certification for HIPAA, PCI, SOC 2, or anything else
- Not a guarantee that nothing exists beyond what I found
- Not an audit of your internal network — everything is remote and external
- Not a sales call for software I happen to resell, because I don't resell any
How the engagement runs
About two weeks, and roughly two and a half hours of your time in total.
-
We confirm it's a fit — no charge
You get in touch, I ask about your size and what prompted the call. If you'd be better served by someone else, I'll tell you and point you somewhere useful.
-
Agreement, then payment
A plain-language agreement covering scope, price, timeline, and exactly how I handle your information. Nothing starts before it's signed and the invoice is paid.
-
Intake questionnaire
About 15 minutes, no technical knowledge needed. "I don't know" is a valid answer throughout — and tells me something useful on its own.
-
I research your public exposure
Done before we speak, so I arrive at the session already knowing what the outside world can see. This also means the session is spent on things only you can tell me.
-
Working session — 90 minutes, video call
A conversation about how the business runs. No wrong answers and nothing to be embarrassed about; most businesses your size have the same gaps, which is rather the point.
-
Report within 7 business days
Delivered securely, password protected, yours to keep and share. I ask that you read at least the summary before we talk.
-
Walkthrough call — 60 minutes
We go through the findings together, answer your questions, and agree on the three things worth doing in the next two weeks. Then you're done, and you own everything.
One price
Small Business Security Assessment
Businesses with 1–20 people
$995 flat fee
- Independent verification of public exposure
- 90-minute working session
- Full written report, ranked findings
- 60-minute walkthrough call
- Delivered in about two weeks
Fixed before we start, in writing. If your business turns out to be more complex than 20 people and one location, I'll tell you before you pay — not halfway through with a change order.
Questions owners ask
Why is this so much cheaper than other assessments?
Because I'm not doing the same thing they are. A $5,000 assessment typically includes vulnerability scanning across internal infrastructure and some penetration testing — which makes sense for a company with servers, a network team, and a hundred endpoints.
You have none of those things. Most of that work would produce nothing for you. I've scoped this to the risks that actually apply to a business your size, which takes less time and costs you less.
Will you need access to our systems?
No. Everything is either publicly available information or something you tell me in conversation. I never log into your accounts, never install anything, and never ask you to run a script or grant remote access.
That's partly about trust and partly about liability — for both of us. It also means there's no technical prep work on your end.
What if the report finds something bad?
Then you'll know, which is better than not knowing. I rate findings honestly, but I rate them in context: a missing security header on a brochure website is not the same problem as an exposed remote desktop port, and the report won't pretend otherwise.
Every finding comes with a next step, and I'm clear about which ones you can handle yourself versus which need a vendor. Nothing in the report is designed to frighten you into buying something, because there's nothing for me to sell.
Can you just fix the problems too?
No, deliberately. The moment I both find problems and sell the fixes, you can no longer be sure whether a finding is real or a sales opportunity. Keeping those separate is what makes the report trustworthy.
I'll describe fixes in enough detail that you or any competent IT provider can carry them out, and I'll name the category of tool you need without pushing a particular brand.
We're a one-person business. Is this overkill?
Possibly, and I'd rather say so than take your money. If you're solo with no employees, no client data beyond contact details, and no website, start with the free checklist and the newsletter.
But if you're solo and handle client financial records, health information, or legal files — a bookkeeper, a therapist, a solo attorney — then you hold sensitive data with no safety net, and an assessment is very much worth it.
Does this make us HIPAA or PCI compliant?
No, and be wary of anyone who says their assessment does. Compliance is a formal process against a specific framework, usually involving documentation, policies, and in some cases a qualified assessor.
What this does give you is an honest picture of your actual security posture, which is a sensible thing to have before you start a compliance process — and the report will flag where your situation has regulatory implications you should look into.
What happens to our information afterward?
Working files and research notes are deleted 90 days after the walkthrough call. I keep the signed agreement, as I'm required to. Nothing is shared with anyone, used as a case study, or published.
Retention terms are written into the agreement, so you don't have to take my word for it. If you want everything deleted sooner, ask and it's done.
Should we do this again later?
Eventually, yes — most small businesses benefit from a fresh look once a year or after a significant change, like moving email platforms or doubling headcount. Your environment drifts, and so do the threats.
I'll mention it at the walkthrough call if it makes sense for you, and then leave you alone about it.
Let's find out where you stand
The first conversation costs nothing and I'll tell you honestly whether an assessment is worth it for your business.