No mystery.
Here's exactly what happens.
A lot of people want to call a security consultant but don't because they're not sure what they're signing up for. We get it. So here's the whole process, start to finish — nothing hidden.
Four steps from your first message to a safer business
Most clients go from first contact to a completed report in under two weeks. Here's what each step actually looks like.
You reach out — we respond within one business day
Fill out the contact form, send an email, or call us directly. Tell us a little about your business and what's on your mind. There's no commitment involved — you're just starting a conversation.
- We respond within one business day, usually same day
- Craig or Kylee will contact you directly — no assistant, no call center
- You can ask any questions before committing to anything
A free 30-minute call — no agenda, just questions
We'll schedule a quick call to learn about your setup. How many people work there? What kind of equipment are you running? Do you have remote workers? Do you take payments on-site? No technical knowledge required on your end — we're just getting the lay of the land.
What we'll ask about:
- How many people use your network and roughly how they use it
- What hardware you have — routers, switches, access points (best guess is fine)
- Whether you handle any sensitive data — customer info, payment cards, health records
- Any specific concerns you already have
We come to you, look at everything, and tell you exactly what we find
Craig and Kylee come to your location — your office, your shop, wherever your network lives. We plug in, run our tools, walk your space, and do a thorough hands-on review of your whole setup. You don't need to prepare anything or do anything in advance.
- We review your firewall rules and configuration
- We test your Wi-Fi for isolation and unauthorized access points
- We map your network and identify how devices are connected
- We check for outdated firmware, open ports, and common misconfigurations
- We look for anything that would let a problem on one machine spread to everything else
Quoted upfront. No surprises.
After this call we'll give you a single fixed quote based on your specific situation. You approve it before anything starts — and whatever we find on-site, that number doesn't change. No hourly billing, no scope creep, no surprise invoice.
You get a written report in plain English — and we walk you through it
Within a few days of the site visit, we deliver a written report covering everything we found. Not a spreadsheet of technical flags — a real document that explains what each issue means for your business, how serious it is, and what to do about it in priority order.
- Written for business owners, not IT departments
- Every finding is rated by urgency — critical, moderate, or low priority
- Specific, actionable steps — not vague recommendations
- We sit down with you and walk through the whole thing
After that, what happens next is entirely up to you. We can help implement the fixes — or you can take the report to whoever handles your IT. No pressure either way.
Report delivered within 3–5 business daysWhat we never do
We know what bad consulting experiences look like. We've built our whole practice around avoiding them.
Use scare tactics
We won't exaggerate threats or manufacture urgency to pressure you into spending more than you need to. If your network is in reasonable shape, we'll say so.
Surprise you with the bill
We quote the job after scoping your situation — you approve it before we start. Whatever we find on-site, the price doesn't change. No hourly overages, no scope creep, no surprise invoice.
Send someone else
You talk to Craig and Kylee at every stage. Not a junior technician, not a subcontractor. The people you hired are the people who show up.
Write reports you can't read
Every finding is written in plain language. If we can't explain why something matters to your business, it doesn't belong in the report.
Push you toward products we sell
We're consultants, not resellers. Our recommendations are based on what's best for your situation, not what earns us a commission.
Disappear after the report
Questions come up after the fact — that's normal. We're reachable after delivery and happy to clarify anything in the report or talk through next steps.
Things people usually want to know before they call
Not at all. We work with business owners who know exactly what a VLAN is and ones who aren't sure what their router looks like. Our job is to understand the technical side — your job is just to tell us how your business runs. We'll handle the rest and explain everything we find in terms that make sense to you.
Often, yes. General IT support and dedicated security consulting are different disciplines. Many MSPs focus on keeping things running day-to-day — helpdesk tickets, software updates, hardware. Security auditing is a different skill set that requires hands-on review of how your network is actually configured, not just whether it's operational. We've worked alongside IT companies many times and it's almost always a complementary relationship, not a conflicting one.
From first contact to receiving your written report, most clients are done in under two weeks. The free call is usually scheduled within a day or two of reaching out, the on-site assessment typically takes about half a day, and the written report arrives within 3–5 business days after that. The timeline can flex around your schedule — we're not going anywhere.
The assessment and the report are a complete, standalone engagement. We quote the price after scoping your situation — you approve it before we start, and that number doesn't change regardless of what we find. If you want us to help implement fixes afterward, that's a separate conversation with its own separate quote. You're never obligated to hire us for anything beyond the assessment, and we'll never use what we find as leverage to pressure you into spending more. The report belongs to you — take it anywhere you like.
Small businesses are actually the most common target for cyberattacks — precisely because attackers know smaller operations are less likely to have strong security in place. You don't need a 500-person company to have sensitive data worth stealing. If you take payments, keep client records, or rely on your network to run your business, then protecting it is worth your attention. That said, our assessment is designed to be proportionate — we're not going to recommend enterprise-grade infrastructure you don't need.
We price each assessment based on your specific situation — the size of your location, how many devices and users are on your network, and the complexity of your setup. We quote one price upfront based on your situation — you know the number before we start, and it doesn't change. The best way to get a quote is to reach out and tell us a bit about your business. The initial call is always free with no obligation.
Start with a free 30-minute call. No commitment.
Tell us a bit about your business. We'll tell you honestly whether we think you need anything — and if so, exactly what that would look like.
Craig & Kylee Coffey respond to every inquiry personally.