Managed security · Spokane, WA
One security standard. Every client. Proof every month.
We build every client to the posture your cyber policy already describes, run it every day, and hand you the evidence each month. Brokerage, law firm, laboratory or contractor bidding public work: the standard is the same, because the attackers are.
- 24/7/365
- Security operations center staffed by real analysts
- Every request
- Checked for who, which device and what access, in the office, at home or in the field
- Every sign-in
- Multi-factor, with administrator rights taken off staff computers
- Every month
- Evidence collected and filed where you can open it; a formal report every quarter
The policy you signed
Your insurer listed the controls. Does your provider know the list exists?
When you renewed your cyber policy, you attested to specific controls: multi-factor everywhere, backups that cannot be encrypted, logged access, a response plan. Those attestations are the terms of the policy. If they were not true on the day of a claim, the claim is in question.
Most IT providers have never read that list, and many would not know how to meet it. They bill monthly for fixing what breaks and call it security. Ask for evidence and you get a screenshot.
Our team has sat in the room after an incident, when the adjuster asks for the restore log and the access records and the provider has neither. That room is where this company comes from.
There is no foolproof way to stop ransomware, and anyone who promises one is not being straight with you. What can be built is the posture your policy describes, operated every day, with a record that shows it. That is the whole product. That is what the $250 per endpoint buys.
- Multi-factor authentication enforced on email, remote access and admin accountsScreenshot of one user's settings
- Backups immutable, off site, restore tested within 90 days"Backups run nightly"
- Endpoint detection and response on all devices, monitored 24/7Antivirus license receipt
- Privileged access logged and reviewedNo response
- Written incident response plan, exercised annuallyAttached a template
- Security awareness training for all staff"We sent an email about phishing"
Responses are invented for this example. The controls are typical of current policy applications.
Three commitments
How we work, on every account.No exceptions, no add-on tiers.
One standard, not tiers of protection
We do not maintain a reduced-security option. The controls that protect a broker-dealer protect your business, because attackers do not check your industry first.
Every control on your invoice
The $250 per endpoint is the whole service fee. Software is itemized at list price with no markup. Each line names the control and the requirement it supports, so when someone asks you to prove it, the record already exists.
Proof, not promises
We test restores every quarter and document the result. We collect evidence monthly whether or not anyone asks. When an examiner, insurer or general contractor comes calling, you are not scrambling.
One connected posture
Seven layers. One program.Hover or tap a layer.
Security is not a product you buy once. It is layers that check each other, run every day, and leave a record. Every layer below is either inside the $250 per endpoint or billed exactly as marked. Nothing is hidden in month three.
Layer 1 · Gateway
Inside the $250 per endpointSecure access at the edge
Every connection your staff makes, in the office, at home or on a job site, goes through the same managed checkpoint. It replaces the office firewall and the VPN.
Why it is in the standard
There is no inside anymore. The checkpoint travels with the person, so the office and the kitchen table get the same rules.
The question it answers
Is remote access secured and logged? Is the firewall managed and current?
Layer 2 · Identity
Inside the $250 per endpointVerified sign-in, every time
Every login checks who you are and whether the device is managed and healthy. Administrator rights are removed from staff computers. Passwords live in an enforced manager, not in a browser.
Why it is in the standard
Almost every breach starts with a credential. A stolen password alone should get nowhere.
The question it answers
Is multi-factor enforced on email, remote access and admin portals? Who holds administrator rights?
Layer 3 · Detection
Inside the $250 per endpointDetection and response, watched 24/7
Every managed computer reports suspicious behavior the moment it happens. A security operations center staffed around the clock investigates and acts, then escalates to our team.
Why it is in the standard
An alert nobody reads at 2 a.m. is not detection. A person acting on it is.
The question it answers
Is endpoint activity monitored around the clock? Who responds, and how fast?
Layer 4 · Devices
Inside the $250 per endpointManaged, patched, encrypted
Every computer is enrolled, inventoried, encrypted and patched on a schedule. Phones and tablets used for work are managed too, so a lost device is a wiped device.
Why it is in the standard
Most intrusions use a flaw that had a fix available. Patching is unglamorous, and it is where programs quietly fail.
The question it answers
Are devices encrypted? How quickly are critical patches applied, and can you show it?
Layer 5 · Backup
Inside the $250 per endpointThree copies, one of them untouchable
Your data is kept in three places, on two kinds of storage, with one copy off site in cloud storage that cannot be altered or deleted before its retention date, even by an administrator, even by an attacker holding admin credentials.
Why it is in the standard
Ransomware now goes after the backups first. A copy that cannot be encrypted is the difference between a bad week and a closed business.
The question it answers
Are backups immutable and off site? When was the last restore tested, and where is the record?
Layer 6 · Email
Billed per mailbox, at list priceEmail protection, archive and training
Premium filtering with impersonation protection, a tamper-resistant archive, a second independent backup of mail outside the primary platform, and security awareness training with phishing tests for every person who has a mailbox.
Why it is in the standard
Email is the number one way in. It is billed per mailbox because every organization has more mailboxes than computers.
The question it answers
Is there impersonation protection? Is mail archived and retained? Is staff trained, and how often?
Layer 7 · AI logging
Separate service, billed on usageManaged, logged AI usage
Staff use AI through a managed gateway. Every prompt and response is logged, retained and searchable, and the record belongs to you.
Why it is in the standard
When a regulator, insurer or client asks what your staff did with AI and when, a defensible answer exists.
The question it answers
Which AI tools does your staff use with client data, and what is the record?
What it costs
$250 per endpoint is the entire service fee.Not a markup on labor. The floor cost of doing this correctly.
An endpoint is a computer we manage: every office worker's machine, and every laptop that leaves the building. Everything required to run the security program on that machine is inside the number. Software is billed at list price with zero markup, itemized so you can check it.
Per managed endpoint · every client, every account
$250from, per endpoint each month
- Secure access at the network edge with a managed gateway, replacing the firewall and the VPN
- Verified sign-in on every login and device; administrator rights removed
- Detection and response on the endpoint, investigated by a 24/7 security operations center
- Enforced password manager, so credentials never live in a browser
- Full device monitoring, encryption and patching, including work phones and tablets
- Three-copy backup with an off-site copy in storage that cannot be altered or encrypted
- Monthly evidence of every control, a quarterly report, and a quarterly restore test
- A direct line to people who know your setup
There is no reduced-security tier. If a control on this list is not running on one of your machines, the monthly report says so.
See the full breakdownPer mailbox · billed separately, at list price
Email protection and training, for every mailbox you have.
Email is the number one way in, so every client gets this. It is priced per mailbox, not per computer, because every organization has more mailboxes than machines: shared inboxes, accounting@, former staff kept for retention, and field crews who have email but no office computer.
- Premium spam filtering with impersonation protection
- Tamper-resistant email archive for retention
- A second, independent backup of mail outside the primary platform
- Security awareness training with phishing tests, assigned and tracked
Also separate, only where needed
File and collaboration platform licenses per seat. Phone system. Cameras. Virtual desktops. Managed, logged AI usage. Three-year device leasing. Each is quoted on its own line, at list price, before you commit.
Vendor prices rise sometimes. When one does, you hear about it from us early, in writing, never buried in an invoice.
Around the clock
At 2 a.m. on a Sunday, a person is watching.Not an alert email nobody reads.
Our clients are monitored by a security operations center staffed 24 hours a day, 365 days a year, by real security analysts. It is part of the standard on every account, not an upgrade.
- 01
Detect
Every managed computer reports suspicious activity the moment it happens.
- 02
Investigate
Analysts in a 24/7 security operations center look at it, day or night, weekends and holidays.
- 03
Respond
Real threats are acted on and escalated to our team, with the record kept for your file.
In and out of the office
There is no wall. There is verification.Continuous, wherever your people are.
Older security was a castle: a firewall at the door and trust for anyone inside. That model assumes an office, and assumes the inside is safe. Neither is true anymore. Our standard does not care where a request comes from. It checks who, which device and what is being asked, every time, and writes it down.
The office
Same checks as everywhere else
Being inside the building earns nothing. The desktop at reception is verified the same way as a laptop in a hotel.
Home
Same posture, no VPN
Remote staff connect through the same managed checkpoint, on managed devices, with the same detection running. The home router is not part of your security.
The field
Crews on phones and shared tablets
Field staff get managed devices, verified sign-in and secure access to only what the job needs. A phone left in a truck is wiped, not worried about.
A second office
One standard at every site
A second location, a second state, a job trailer: each gets the same gateway, the same policies and the same monthly evidence. Not a copy. The same program.
No physical office is required. A firm that works entirely from home and job sites gets the full standard, the same report and the same people on the phone.
Evidence
Security you cannot demonstrate is security you cannot defend.
Every month we collect the artifacts: patch status, threat detections, sign-in records, device health, backup and retention status, access reviews. They are filed where you can open them directly. Not a summary. The artifacts.
Every quarter you receive a formal report: each control on your invoice, whether it ran, and the artifact that proves it. It is written for the person who has to hand it to an insurer, an examiner or a general contractor, and it is the document those people ask for.
Every quarter we also restore your data and verify it. A backup report proves a job ran. A restore test proves your business can come back.
── evidence record · example month ──[ ok ] patches applied · every managed computer[ ok ] threat detections reviewed and closed[ ok ] sign-ins without multi-factor · blocked[ ok ] device health checked · encryption on[ ok ] backups verified · retention locked[ ok ] access review filed[ ok ] phishing results reviewed · training assigned── filed to your evidence folder ──
Industries
Built for businesses that get asked to prove it.
Plainly
If your current provider cannot show you monthly evidence of every control on your invoice, you do not have a security program. You have a service contract.
No one can guarantee you will not be attacked. Not us, not anyone. There is a difference, though, between a provider who checked the boxes once and one who built the program and runs it every day. Every claim on this site can be tested with one question: show me the record.
We built the program. The $250 per endpoint is what it costs to run it properly, with nothing left out to make the number smaller. You will know what is on, what is not, and what it would take to change that, every month, from people who know your setup by name.
Questions
Straight answers.
What is zero trust, in plain terms?
Nothing on your network is trusted just because it is inside the office. Every sign-in, every device and every request is checked before it reaches your email, files or systems, and anything that fails a check is stopped and logged.
Who is watching for threats after hours?
A security operations center staffed around the clock by real analysts. Detections from every managed computer go to them 24 hours a day, every day of the year, and anything that needs action comes to our team.
What happens if a client sends me a security questionnaire?
Send it to us. We will tell you which answers are true today, which are not, and what it would take to change that, before you commit to anything.
Do you support businesses outside Spokane?
We serve Spokane, Spokane Valley, Liberty Lake, Coeur d'Alene, Post Falls and the greater Inland Northwest, with remote support for client locations in other states.
Is $250 per endpoint really everything?
It is the entire service fee for each computer we manage, and everything needed to run the security program on it is inside it. Email protection, archiving and security training are billed per mailbox at list price, because every organization has more mailboxes than computers. Software licenses are itemized at list price with no markup. Anything else, such as phones, cameras, virtual desktops or managed AI logging, is quoted on its own line before you commit.
What does a cyber insurer actually require before it will process a claim?
The application you signed lists them. For most firms today that means multi-factor sign-in on email, remote access and admin accounts; detection and response on every device; backups that cannot be altered or deleted; email protection with impersonation defense; security awareness training; privileged access that is controlled and logged; and a written incident response plan. A law firm needs all of that. A brokerage under FINRA or the SEC adds write-once storage for seven-year retention, formal audit trails, encryption at rest and in transit, scheduled penetration testing and a written information security program. A contractor across several sites adds one consistent posture at every location, secure remote access for field crews, and mobile device management. Meeting the minimum gets a policy issued. Running it as a standard, with monthly evidence, is what stands up when a claim is reviewed.
What is the difference between meeting the minimum and running a standard?
The minimum is a checklist a provider can tick once, on the day of the application. A standard is the same controls operated every day, with the artifacts filed every month, so that when an insurer, examiner or general contractor asks, the answer is a record rather than a memory. The minimum gets you a policy. The standard gets you evidence.
My cyber insurance renewal lists controls. Can you tell me which ones I have?
Yes. Send us the application or the policy's control list and we will tell you, in writing, which are in place today, which are not, and what it would take to change that. We do this before anyone signs anything.
Can you make my business compliant?
No, and that is the right answer. We design, run and evidence the security controls. Whether you are compliant is decided by you and your counsel, compliance officer, auditors or accreditation body, using the evidence we produce.
Start here
Send us the questionnaire.
If a client, insurer or general contractor has sent you a security questionnaire, or your policy renewal lists controls you are not sure you have, send it over. We will tell you which answers are true today, which are not, and what it would take to change that, before you commit to anything. A person replies, within one business day.
Book an assessment