Pricing
One plan. Priced for a business that is not big yet.
Most security firms will not work with a twelve-person company, because selling to one costs the same as selling to a hundred-person one. That is a business problem on their side, not a reason you should be the easiest target on your street.
Security Essentials
$199 per month
$395 one-time onboarding, which covers the assessment and the setup work in month one.
Everything a small team actually needs to stop being the easy target, set up properly in the first month and kept that way after.
- Fits
- Up to 20 users, one domain, one Microsoft 365 tenant.
- Term
- Three-month minimum, then month to month. Thirty days' notice to stop.
No card, no obligation. We will tell you if you do not need us.
First month
- Full security assessment across identity, Microsoft 365, endpoints, DNS and backups
- Written findings in plain language, with a prioritised list of what to fix first
- MFA and Conditional Access reviewed, with the gaps closed rather than just reported
- SPF, DKIM and DMARC corrected and put on the path to enforcement
- A walkthrough call, and the report is yours to keep
Every month after
- DMARC reports read by a person, not collected in a dashboard you never open
- Policy advanced to p=reject as the reports come back clean, then held there
- Configuration drift checked against the state we left you in
- New Microsoft security settings assessed for whether they matter to you
- A short written update each quarter you can hand to an insurer or a customer
Whenever you need it
- A named person to ask, by email, without opening a ticket
- Answers to security questions on insurance forms and vendor questionnaires
- A second opinion before you buy a security product you may not need
- An honest answer when the right advice is that you do not need us for something
Prices are in US dollars and exclude Microsoft licensing, which you buy directly and own. There is no setup fee beyond the one above, no per-user charge, and no annual contract.
Why three months and not one
Stopping someone from forging your domain is not a setting. It means finding every system that legitimately sends mail as you. Your accounting software, your booking tool, the newsletter someone set up in 2019. Each one has to be proved authenticated before the policy is tightened. Miss one and that system's mail stops being delivered.
That evidence arrives in daily reports, which is why it takes weeks rather than an afternoon. Three months is how long it honestly takes, so that is the commitment. After that it is month to month, and thirty days' notice ends it.
If you leave, you keep the assessment, the report, and every record we published. Nothing we set up stops working because you stopped paying.
Outside the plan
Quoted, because a number here would be a guess.
Named rather than hidden behind "contact us", so the absence of a price reads as a reason instead of a tactic.
- More than 20 users
- The plan is built around small teams. Past 20 the identity and admin surface grows faster than the headcount does, so it needs scoping.
- Additional domains
- Each domain has its own senders to find. The second is rarely as much work as the first, and it is priced that way.
- Hardware and endpoint refresh
- Hardware is passed through at cost. The work around it depends on how many machines and what is on them.
- Incident response
- If something has already happened, that is not a subscription. Call and we will talk about it properly.
- Regulated data or multiple tenants
- Health, financial or legal records raise the bar on evidence and documentation. Worth a conversation before either of us guesses.
If $199 a month is still the obstacle, say so. A business that cannot afford security is exactly the one that cannot afford an incident. Work can be staged, and a first client in a new industry is worth something. That conversation is easier to have against a published number than against silence.
Who you are actually hiring
A working security engineer. Matthew does this full time at a managed service provider, doing incident response, endpoint security, and Microsoft 365 and Entra ID administration across dozens of business tenants. He holds CySA+, Security+ and ISC2 CC, with a Master of Science in Cyber Security in progress at the University of North Dakota.
No sales team, no account manager, no handoff to someone junior after you sign. More about the practice.
Start by finding out whether you have a problem.
The domain check is free, takes ten seconds, and tells you what the rest of the internet can already see. If it comes back clean, you have saved yourself a phone call.