Small-business cybersecurity questions, answered plainly.

The free Exposure Review takes minutes because it uses passive public information. Most paid fixed-scope projects can be completed in less than two weeks once scope and evidence sources are confirmed.

No. We can work with your existing provider or directly with leadership. The available evidence and agreed access determine what can be verified.

No. We do not provide general help-desk or day-to-day managed IT. We independently verify security controls and document the observed state.

Yes. The Baseline is designed to give leadership an independent view while providing technical findings the existing provider can address.

They may well handle a lot of it. We don't replace your IT provider; we independently confirm the controls you're relying on, many of which fall outside a standard IT contract. The free review uses only public information, so it doesn't interfere with anything they manage. If everything checks out, we'll tell you, and you'll have the documentation to show insurers and customers.

Four questions to ask your IT provider:

1. Is our email domain set to reject fake messages, and can you show me the setting?
2. Is MFA enforced on every account, including admin and old shared mailboxes?
3. Who checks for hidden mailbox forwarding rules and suspicious sign-ins, and how often?
4. If I fill out our cyber insurance application today, can you give me evidence for every "yes"?

If you get confident answers with evidence, great. If you get "I'll have to check," start with the free review.

Tyson Benson, Security & Engineering Lead, brings automotive cybersecurity compliance and offensive security research experience. RBC provides strategic counsel informed by CISO and IT Director experience. The About page describes their backgrounds and links to Tyson's external recognition and RBC's security blog.

No. It uses public signals and does not exploit systems. A public signal is not automatically proof of a vulnerability or compromise.

The free Exposure Review requires only a business domain and matching work email; it does not require passwords or internal access. The Business Security Baseline uses only the agreed evidence sources, often read-only exports, screenshots, or documentation from you or your IT provider. After results are delivered, leadership receives a clear conclusion and your provider receives the evidence and verification steps needed for next actions. See the privacy policy for exactly what is retained and for how long.

No. The Baseline documents observed controls and evidence; it is not a certification, legal opinion, or guarantee of acceptance under a particular customer or insurer standard. It may still provide useful evidence when you are answering a customer questionnaire or renewing cyber insurance.

It is the fixed public price for the defined Business Security Baseline scope for businesses with up to 25 employees. Larger businesses receive a confirmed quote after scoping. See the pricing page for the full comparison of offers.

You may use your existing provider or request a separate fixed-scope proposal after the relevant gap has been identified. Remediation is intentionally a separate decision from the assessment.

Continuous External Monitoring establishes a public exposure baseline, watches for meaningful changes to domains, services, email posture, and relevant vulnerability signals, then prioritizes what appears to deserve attention. It is not a raw alert feed: we correlate observable technology and changes with current intelligence, consider applicability and uncertainty, and focus attention on items that appear relevant. Monitoring and implementation remain separate, and the scope is confirmed before work begins.

Security awareness training uses short scenarios, decision practice, feedback, and completion records inside a training workspace. Managed phishing testing sends controlled simulated emails to authorized participants and reports campaign interactions. They can be purchased separately, or discussed together in an annual bundle.

No. We offer launch pricing for smaller teams, with larger programs scoped individually. The service is designed for small and midsize businesses that want a managed campaign without building a security platform in-house.

No. Managed phishing testing is a direct service and can be requested without the Security Baseline.

The standard annual program includes four campaigns over 12 months, four short training assignments, completion reminders, campaign reports, and an annual summary and readout.

Yes. See cybersecurity for trucking and logistics companies—covering dispatch, TMS, load boards, and carrier-identity fraud—and cybersecurity for small manufacturers, which addresses purchasing, scheduling, and supplier access. Each industry page includes its own frequently asked questions.

See cybersecurity for accounting and tax preparation firms and WISP support for tax preparers. We can develop or review a tailored Written Information Security Plan within an agreed scope and review agreed evidence for safeguards. Your firm remains responsible for its security program; this is cybersecurity consulting, not legal advice or a compliance guarantee. The free Exposure Review uses public signals only, while internal safeguard verification requires a separately scoped assessment.