Assess. Harden. Steward.

01 · Assess

A clear picture of where you stand.

A point-in-time assessment of the parts of your digital life that face outward, chosen to fit you:

• External footprint — your domains, DNS, mail authentication, certificates and anything exposed to the internet, read from public records.
• Website — the server and stack, encryption, browser-protection headers, exposed files, content-system posture and the forms that collect personal data, checked against the OWASP Top 10.
• Vendors — the services you depend on and what they can reach, reviewed from documents and your own records. We never probe a vendor's systems.
• Devices and accounts — Mac baselines against the CIS Apple macOS Benchmark; phones and the accounts behind them: sign-in, recovery paths and the second factor.
• Connectivity — the home or office network and the way its pieces reach each other.

Every finding is rated by likelihood and impact, tagged with the effort to fix it, and paired with what we'd do about it. We record what you're doing right, too.

You receive a one-page Security Snapshot and a full report. See a sample →

02 · Harden

Fixes, made by hand, with you in the room.

The findings become a worklist, and we work it with you present — you hold the credentials, you approve each change. Typically:

• Phishing-resistant sign-in — hardware security keys or passkeys on the accounts that matter, with recovery paths that don't quietly undo them.
• Devices kept current and encrypted, with the settings that matter checked rather than assumed.
• Mail that proves where it came from — SPF, DKIM and DMARC published and enforced in stages, with the reports read before each step.
• Backups a thief can't reach — an off-site copy, encrypted before it leaves, and a copy that can't be quietly rewritten.
• Access cleaned up — stale app grants, departed helpers and forgotten shared logins, revoked and recorded.

Then we re-test. A fix isn't done until the finding is closed.

03 · Steward

What happens to all of it when you can't manage it yourself.

An orderly, secure plan for your digital succession: an inventory of the accounts, devices, keys and records that matter; who may reach what, and when; recovery paths that have actually been tested; and a sealed record kept where the right people can find it. Reviewed on a schedule, because accounts change.

For estate-planning firms, we build digital-succession programs that run inside your own engagement, under your privilege.

04 · When something has already happened

A calm first hour.

If you think something is wrong right now — a message you shouldn't have clicked, an account you can't get back into, a device behaving strangely — say so in your first message. We'll help you contain it, preserve what matters, decide who needs to be told, and get back to normal; and we'll say plainly when it's time to bring in counsel, your insurer or law enforcement.

A second opinion, too: when a scanner, a vendor or an insurer has flagged something, we'll tell you whether it's real and what it actually means — inside a signed scope if it takes more than a look at public records.

And a plain answer about a suspicious email, link or message: what it is, and what to do.

05 · Who this is for

• Households and individuals — people who hold their family's records, money and memories online and would rather keep them. Plain English, no condescension, no fear.
• Small businesses — owners with a website, a mail domain, a few devices and no IT department.
• Small legal and client-trust practices — firms that carry privileged files and client trust accounts, where the standard isn't "good enough" but "defensible". The same work, scoped around the obligations you carry.

06 · What we don't do

• No penetration testing, no red-team exercises, no exploitation, no credential cracking against live systems.
• Nothing without written authorization from the owner of the system.
• No round-the-clock monitoring service. This is a small practice, and we'll say so when a need is bigger than we are.
• No legal advice. The principal was a trial lawyer; he no longer practices law.
• No products pushed. We have no affiliate, dealer or referral relationships. If that changes, it will say so on this page.

07 · How it's priced

Scope first, price in writing. Every engagement is quoted in writing before it starts, against a scope that names what we'll look at and what we won't.

Start a conversation →