Serious security and AI, sized for a business like yours.
Assessly gives small businesses the security, planning, and AI help that bigger companies keep whole teams for — practical, fixed-price, and built to be run by the people you already have. Backed by governance experience at the federal, state, and city level.
Fixed scope, fixed price, agreed before anything starts. Usually two to four weeks.
Something forced the issue.
Most people don't call because they woke up thinking about security. Something made it urgent — usually one of these.
A customer or partner wants proof you're secure
A questionnaire, a contract clause, or a due-diligence request — and nobody internally sure how to answer it.
How I handle it →Your team started using AI and nobody set rules
Client data is going into chatbots. You need a policy people will actually follow, not a ban they'll ignore.
How I handle it →Your insurer or bank is asking questions
Cyber insurance renewals now come with real requirements. Answering wrong costs you the policy or the rate.
How I handle it →What I can do for you.
Each one is its own page, with the price on it. Not every job fits a box — if yours doesn't, just ask.
Security & planning program
Policies, an access list, tested backups, and an incident plan — the foundation a small business is expected to have, built to run itself.
Security frameworks & control coverage
Map your business to NIST CSF 2.0 and CIS Controls, and get a one-page “are we covered?” view for a customer or a board.
AI use policy
Written rules for how your team uses AI tools, plus the training so they stick — not a ban they'll quietly ignore.
AI agents & tools
Custom AI tools that do the repetitive reading and sorting your staff do by hand — and show their work, so a person can verify it.
Websites & internal tools
Fast, plain, maintainable web work. This site is an example — hand-built, no page builder, loads instantly.
Penetration testing (light)
A practical external look for the obvious ways in — clearly scoped, not a deep red-team engagement, with a plain-English writeup.
No six-week discovery phase.
Thirty minutes, free
You describe what happened. I tell you honestly whether you need me. Sometimes you don't.
One page, one price
What you get, when, what it costs. No hourly billing and no surprise second invoice.
Weekly updates
Short written check-ins. You see drafts as they exist, not a reveal at the end.
Yours to run
Editable files, a walkthrough with your team, and thirty days of questions at no charge.
Built for
- Small businesses, roughly 5 to 150 people, with no security staff
- Nonprofits and associations with a board asking questions nobody can answer
- Owners who want plain English and a fixed price, not a retainer
- Teams adopting AI who want guardrails before something goes wrong
Not built for
- Large corporations with in-house security teams — you need a firm, not one person
- Government bodies where a conflict of interest would apply — declined on principle, no exceptions
- Live incident response — if you're being attacked right now, call an IR firm and I'll name one
- Deep, adversarial red-team engagements — the light testing I offer isn't a substitute
Tell me what happened.
Six questions, two minutes. I reply to every message within two business days, including the ones I turn down.
Get in touch