Start with a Security Checkup of what anyone on the internet can already see: your certificate, your security headers and your email protection. Then, if you want it, I lock it down: email, logins and multi-factor sign-in, set up properly and written down.
Defend is for Phoenix offices, restaurants and professional firms that hold other people's information and do not have a security person on staff. Every engagement is scoped to your actual setup. Bring what you have, and we scope from there.
Most small-business security problems are not exotic. They are an expired certificate, a missing email record, a shared password in a group chat, or a former employee who can still sign in. Those are fixable, and fixing them is most of the job.
A look at your public settings only, the same things an attacker or a spam filter sees from the outside. No logins, no active testing. It runs instantly and gives you plain-English results with fix-it steps. Want a second pair of eyes? Send me the report and I will review it personally.
We ran this checkup on our own site first, and the old one failed parts of it. See what the checkup covers.
The fix list, done. Each item is configured, tested and written down in a handoff document you keep.
The promiseYour email passes SPF, DKIM and DMARC checks at handoff.
Some offices need more than a settings review. Penetration testing is available on systems you own or are authorized to test, and only after a written scope and written permission are signed. The scope covers external and web-application testing, a findings report, remediation guidance and a re-test to confirm the fixes. The findings window is set in your written scope.
I never run active tests against a domain someone submits for the free checkup. The checkup reads public settings only.
Accounting firms are prime phishing targets, especially in tax season, and clients still email tax documents. If you prepare returns, IRS Publication 4557 and the FTC Safeguards Rule expect a written security plan. An engagement with a regional CPA firm is under way. I work around the tax software you already run.
Front-desk email, shared logins and old staff accounts are where small practices get caught. I tighten email, sign-in and access, and help you get ready for a HIPAA review. Readiness help, not certification. Nobody can promise an assessment outcome.
Staff turnover means passwords travel. I set up separate logins, multi-factor sign-in on the accounts that touch money, guest Wi-Fi kept apart from the business network, and an offboarding checklist the manager can actually follow.
Moving a website is when email breaks, because the domain settings that point to your mail get touched. On Aerion Glavac Skinner's launch, her business email on Microsoft 365 kept working through the whole move.
Sam's understanding of technology, combined with his relentless work ethic, sets him apart. He consistently puts in the effort to ensure tasks are completed efficiently and effectively, a rare and valuable trait.Dean Trempelas · Director of Partner Success, Empath · former colleague
An author and speaker site, with business email kept working on Microsoft 365 through the move.
Passed · SMHome base is the Phoenix metro, from Scottsdale to Queen Creek. Most Defend work happens remotely, because email records, certificates and sign-in settings live in the cloud. When it helps to sit with your office manager and walk the logins together, I come to you. At GoDaddy, 2014 to 2019, I did customer-facing hosting and SSL/TLS support for small-business clients. At Norton (Gen Digital), 2024 to 2025, I handled 200+ customer security incidents. The patterns repeat, and so do the fixes.
Yes. It runs instantly on public settings only: your certificate, security headers, email records and AI-readiness. You get plain-English results and fix-it steps right away. If your setup is in good shape, it says so.
Readiness help, not certification. Nobody can promise an assessment outcome. I help you configure the controls and write the plan, and you or your assessor make the call.
Discussed case by case.
A written scope and written permission come first. Then external and web-application testing, a findings report, remediation guidance and a re-test to confirm the fixes. Only on systems you are authorized to test. The findings window is set in your written scope.
Not as a round-the-clock service. After a lockdown, a Run care plan keeps certificates renewing and settings checked, with a written note every month. Issues are handled as quickly as possible, in the order they come in.
Run the free checkup, or talk to a tech for 30 minutes and bring your domain. You will leave knowing what to fix first, whether or not we work together.
After a lockdown, keep it locked with a Run care plan. Regulated office? See compliance readiness in Advisory, and read the HIPAA compliance checklist in Notes.