We help small and mid-size businesses find and fix the vulnerabilities attackers will exploit — before they do. Fixed-price engagements. Plain-English reports. Timestamped work logs, so you see exactly what we did and when.
Every engagement has an agreed price before we start. If the work genuinely needs to change, we renegotiate openly — not silently on an invoice.
We sign a mutual NDA before any material work begins. What we find stays between us.
You receive a log of every testing session: what was run, when, and against which systems. No black-box reports.
Engagements of $1,500 or more include a professionally printed binder with all findings, plus an encrypted USB copy. All engagements include encrypted digital copies and timestamped work logs.
What we learn on your engagement is yours. It does not get packaged into a threat-intel feed, cross-referenced with another client, or sold to anyone.
Modern AI tools are being used by threat actors to automate reconnaissance and find vulnerabilities faster than human teams can match. The organizations that weather this shift are the ones that hardened up before they had to.
Every service starts with a clear scope and a fixed-or-quoted price. Engagements that outgrow their scope get a new quote — they don’t get billed as extras.
Starting at $750
Professional automated scanning tools run against your external attack surface, then reviewed by a human analyst who prioritizes findings by real-world risk. Delivered as a plain-English report with remediation guidance for each finding.
$1,800–$3,000 depending on scope
Everything in the Vulnerability Scan, plus manual verification of automated findings and deeper review of network configuration, access controls, security policies, password policies, admin access, and backup procedures. Includes a prioritized remediation roadmap with timeline recommendations and a 30-minute debrief call.
Starting at $3,000 · most engagements $3,000–$6,000
A real attack simulation. We actively try to compromise systems the same way an attacker would, then tell you exactly how we got in and how to close it.
Three types
Testing internet-facing systems — firewalls, email servers, VPNs, public web apps. What an attacker sees from the outside.
Testing a specific web app for flaws in how it handles logins, data, and user input — the kind of bugs that let one user read another user’s data.
Testing what happens once someone is already inside — plugged into your office network or connected via a compromised VPN. Runs remotely using a small dropbox device you install yourself.
Bundle discounts
What you get
$100/hr simple work · full hardening quoted ($1,000–$3,000 typical)
Locking down the network your business runs on. We fix what we find — we don’t just document it.
Simple work ($100/hr)
Full hardening (quoted)
Starting at $700 · typical engagement $700–$1,200
Full security audit of your Microsoft 365 or Google Workspace configuration. MFA enabled for all users, admin access reviewed, email security configured (SPF, DKIM, and DMARC — the three records that stop attackers from spoofing your domain in email), sharing and permissions reviewed, conditional access policies set. Written report of every change we make.
Sizing
$400/month + $500 onboarding
The monthly security guy on retainer. Monthly vulnerability scan with human review, critical-alert notifications between scans, and included advisory time for the questions that land on your desk.
Onboarding includes
Each month includes
$100–$125/hr · 1 hour minimum
Hourly help when you need a second set of eyes. Vendor security questionnaires, policy drafts, scoping work before a larger engagement, incident triage questions — whatever lands on your desk that you’d rather not guess at.
Prices are starting points. If budget is a concern, say so — we’ll work with you.
Hourly rates flex too. Tell us the work and your budget — we’ll figure out a fit.
Most penetration tests we run for small businesses follow the same rhythm.
We enumerate every system, service, and endpoint in scope. You see what an attacker would see before we do anything else.
We test by hand, chaining findings where we can. Automated scanners run in the background; human attention drives the test.
Every finding gets a severity, a concrete fix recommendation, and screenshots showing exactly what we did. No jargon. No CVSS-only reports.
We walk your team through the report live. Questions get answered in person. Fix priorities get negotiated openly.
All prices listed are starting points. Every business is different, and we’d rather work with you on pricing than lose the chance to help. If budget is a concern, say so — we’ll find a way to make it work.
Email the security team with a sentence about what you’re looking at. We’ll reply with scoping questions, not a sales deck.