What I do, each with a price on it.
Every engagement is fixed scope and fixed price, agreed before I start. No hourly billing, no retainer you forget you're paying, no phase two you didn't ask for. Not every job fits a box — if yours doesn't, just ask. Click through for what's actually included.
Security & planning program
The set of things a small business is expected to have and usually doesn't: written policies, a record of who has access to what, tested backups, and a plan for the day something breaks. Built to be run by the people you already employ.
What's included →
Security frameworks & control coverage
A customer, board, or insurer wants proof you're covered. I map your business to NIST CSF 2.0 and CIS Controls and give you a one-page coverage view — strong here, exposed there, fix this first — that a non-technical reader can follow.
What's included →
AI use policy
Your team is already using AI tools. The question is whether client data is going into them and whether anyone would know. Written rules people will follow, plus a short training session so they actually do.
What's included →
AI agents & tools
Custom AI tools that do the repetitive reading, sorting, and cross-checking your staff currently do by hand. Built to show their work, so a person can verify the output instead of trusting it blindly.
What's included →
Websites & internal tools
Fast, plain, maintainable web work — marketing sites, intake forms, small internal dashboards. No page builder, no framework you'll need a specialist to maintain. This site is a sample: hand-written and loads instantly on a phone.
What's included →
Penetration testing (light)
A practical, clearly-scoped external look for the obvious ways in — exposed services, weak logins, out-of-date systems. Not a deep red-team engagement, and honest about that, with a plain-English report and a ranked fix list.
What's included →
Before you click anything.
Which one do I need?
Start with what forced the issue. A customer asking for proof usually means frameworks & control coverage. An insurance renewal or a general sense of exposure means the security & planning program. Staff pasting client information into chatbots means the AI use policy. If you're not sure, describe the situation and I'll tell you — including when the answer is that you don't need any of them yet.
Can I combine services?
Yes, and it's usually cheaper. The security & planning program plus an AI use policy is a common pairing, and the second one is discounted when they run together. See the pricing page for the bundle.
Where do you work?
Everything here is delivered remotely, so I work with businesses anywhere in the US. The only restriction is on the other side: I decline any engagement that would conflict with my public-sector work.
Are you going to try to sell me a retainer?
No. Every service here has a defined end. If you want me back later, you can hire me again for another fixed-scope piece of work. I'd rather you not need me.
What if my business is really small?
Then say so on the intake form. Some of this scales down to a two-person shop and some genuinely doesn't. I'll tell you which, and if the honest answer is "spend $600 on a password manager and MFA instead of hiring me," that's what you'll hear.
Not sure which one fits?
Describe the situation. I'll tell you which service applies, or that none of them do.
Get in touch