You don't need a security department. You need the basics done right.
Most attacks on small businesses aren't sophisticated. A reused password, a fake invoice email or a computer that hasn't been updated is all it takes. I help you close those gaps in order of importance, at a pace and price that fit a small office.
Cybercrime isn't just a big-company problem.
in cybercrime losses were reported to the FBI in 2025, up 26% from the year before.
Source: FBI Internet Crime Report 2025
of that was business email compromise: fake invoices, changed bank details and spoofed payment requests.
Source: FBI Internet Crime Report 2025
of breaches involved ransomware, and small businesses were hit hardest.
How a fake invoice scam works, and how to stop it
A criminal gets into your supplier's email.
Often with one password that was reused on another site. There's no alarm, so nobody notices.
- They quietly read real invoices for weeks
- They learn what you buy, what you pay and when it's due
Hi,
Our bank has changed. Please send today's payment2 of $18,400.00 to our new account3 so your order isn't held.
Then this lands in your inbox.
A real invoice number, the right amount, the usual logo. It looks exactly like the real thing. Can you spot the warning signs?
- 1A lookalike address: a number 1 instead of the letter l
- 2A rush: pay today
- 3New bank details by email
- Vendor
- Ridgeline Supply
- Invoice
- #4471
- Amount
- $18,400.00
- Account
- ending 3306ending 8812
Your bookkeeper pays it.
They update the bank details and send the payment, like any other invoice.
- Banks often can't get it back once it's gone
- Your real supplier is still waiting to be paid
Same scam, with the basics in place.
Email protection
Flags the lookalike address before anyone acts on it.
“Caution: this sender looks like one of your contacts.”FlaggedStaff who can spot a scam
New bank details plus a rush? Your team knows that's a red flag.
“This doesn't look right.”QuestionedA call-back rule
Any bank change gets a phone call to the number you already have.
“We never changed banks.”Stoppedwas lost to fake invoices and other business email scams in 2025.
Source: FBI Internet Crime Report 2025
The basics that stop it are simple, and you can start free.
The free snapshot checks your email security settings, the ones that stop criminals from sending email as your business. No logins, no visit.
Start here. No access needed.
The IT & Security Health Check earns your trust one step at a time. You decide how far to go, and every step gives you something useful.
Free snapshot
I look only at what's public: your email security settings, website certificate, domain renewal and Google listing. One-page summary, no logins.
$295 conversation
An interview about how your office handles backups, sign-ins, vendors and risks. You stay at the keyboard. Written findings in plain English.
$495 technical review
A supervised, read-only review under a signed agreement, with a fix list ranked urgent, soon and someday. Step 2 fee credited.
Six safeguards that stop most attacks
Nothing exotic. These are the same controls cyber insurers and the IRS ask about, sized for a small office.
Multi-factor sign-in
A second step on email, remote access and key software, so a stolen password alone can't get in.
Backups that survive ransomware
Copies kept out of an attacker's reach, and tested, so you know you can get your files back.
Updates and security tools
Computers kept patched, with security software on every one and someone watching the alerts.
Email protection
Settings that stop criminals from sending email as your business, and filtering that catches fake invoices.
Staff who can spot a scam
Short, practical training on phishing, fake payment requests and phone scams, with records.
A written plan
Simple policies and an incident plan: what to do and who to call if something goes wrong.
Got a questionnaire you can't answer?
Insurers now ask detailed questions about multi-factor sign-in, backups, security software and training. I help you answer accurately and put any missing safeguards in place before renewal.
Get help with a questionnaireNeed a written security plan?
Tax preparers are required to have a Written Information Security Plan (WISP). I write it with you, based on IRS Publication 5708, and put the safeguards behind it.
Tax Office SecurityWant it handled every month? IT Care Plus includes security tools on every computer, patching and backup monitoring for $650 a month, up to 25 users.
Common questions
Where should a small business start with cybersecurity?
Start with the free outside-in snapshot. It needs no passwords or access and shows what anyone on the internet can already see about your email and website. From there, the $295 Health Check Conversation gives you a plain-English list of what to fix first.
Is my business too small to be a target?
No. Most attacks are automated. They don't pick businesses by size; they look for a reused password, an email account without multi-factor sign-in, or a computer that hasn't been updated.
Can you help with our cyber insurance questionnaire?
Yes. I help you answer it accurately and put missing safeguards in place before renewal, such as multi-factor sign-in, protected backups and written policies. I'm not an insurance agent, so coverage and pricing questions go to your agent.
What does it cost to protect a small office?
The snapshot is free and the Health Check Conversation is $295. Fixes are quoted up front before any work starts. For ongoing protection, IT Care Plus is $650 a month for up to 25 users and includes security tools on every computer, billed per device at cost.
What should I do if I think we've been hacked?
Disconnect the affected computer from the network but leave it turned on, and don't pay any ransom. If you have cyber insurance, call your insurer's claim or breach hotline first, because many policies require their own response team. Then call me. Plan clients get priority; otherwise emergency help is $175 an hour with a 2-hour minimum.
We're a tax or accounting office. Is there anything different?
Yes. Tax preparers are required to have a written information security plan (WISP). I write it with you and put the safeguards behind it.
Not sure where to start?
Book a free 30-minute IT checkup call. We'll talk through what's working, what isn't, and whether I can help. No sales pitch.