Cybersecurity that fits the size of your business.
A small cybersecurity consulting practice in Orlando. Risk assessments, SOC 2 and HIPAA compliance, virtual CISO, penetration testing, and incident response. Prices are on the site.
Five products. One person on every call.
Each engagement has a written scope, a written price, and a calendar date the work is done. If anything changes mid-project, you sign off first.
Risk Assessment
A look at where your business is exposed, scored against NIST CSF or ISO 27001. You get a plain English report and a 90-day plan.
Compliance & Certification
SOC 2, HIPAA, PCI-DSS, CMMC, NIST 800-171. Gap analysis, the policies you need, evidence collection, and we sit with you during the audit.
Virtual CISO
Monthly retainer. Strategy, board reporting, vendor reviews, architecture sign-off, and incident command. Cancel with 30 days notice.
Penetration Testing
Manual testing of your network, web applications, cloud, and people. PTES and OWASP methodology. Free retest on critical findings.
Incident Response Retainer
Same-day response when something goes wrong. Containment, forensics, breach notification support, and a real plan so it doesn't happen the same way twice.
Most companies under 250 employees do not need a full-time CISO. They need someone who shows up, writes things down, and answers the phone.
Written scope. Written price. Done when I said it would be.
01 · In writing
Every project starts with a one-page statement of work. It names what you're getting, when, and what it costs. If we change scope, you approve it first.
02 · I do the work
I'm the person on the kickoff call, in the audit, on the report. There's no team behind me. If you hire me, you get me.
03 · You keep the files
Policies, reports, runbooks, diagrams: source files go to you. If you ever switch firms, your work goes with you.
Reading for founders, operators, and security leads.
Long-form pieces written for the size of business that actually reads them. No vendor pitches.
A founder's guide to SOC 2 for companies under 50 employees.
What Type I costs, what evidence you need before day one of the audit window, and how to run the engagement without hiring a full-time compliance manager.
Threat LandscapeWhy SMBs became the primary cyber target in 2025.
The economics that drove attackers downmarket, the attack patterns now dominant against 20–200 person businesses, and the controls that move the needle.
ArchitectureZero Trust architecture, without the marketing.
A practical Zero Trust reference for mid-market networks. What the principle actually means, which NIST 800-207 components to prioritize, and what to ignore.
Tell me what you're working on.
Thirty-minute call. I'll ask about your business and what's pushing the question. If I'm not the right fit, I'll say so and point you somewhere better.
No sales engineers, no SDRs, no qualification calls. The email lands in my inbox.