Security and Infrastructure

If you have not had a real security assessment in the last twelve months, you are guessing.

Overview

What this is

This is the credibility floor underneath everything else I do. Before I help you adopt AI or build software, I need to know what you are actually standing on: your networks, your identity and access, your cloud, your endpoints, your backups. A breach is not an IT problem. For a victim services organization it can put someone in danger. For a business holding client data it means lost trust, lost clients, and leadership explaining to a board what happened and why nobody caught it.

I assess where your exposure actually sits, build defensible policy around it, and put technical controls in place that match how your organization really operates. Not a two-hundred-page report that sits on a shelf. A prioritized plan with real timelines and real numbers.

Assess

What I look at

What I assess

Network architecture and how traffic actually moves
Identity and access, who can reach what and whether they should Entra ID, Conditional Access, least-privilege review
Endpoint security and device management
Email security and threat defense Exchange Online, Safe Links and Safe Attachments
Backup and recovery, tested rather than assumed
Cloud configuration and where it drifts from best practice Microsoft 365 and Azure
What your AI tools can reach, which most assessments miss entirely

How I Work

NIST CSF · CIS Controls

How I work

Assess against your reality

The assessment is grounded in recognized security frameworks, then adapted to the size and operational reality of your organization. A ten-person nonprofit and a hundred-person brand do not get the same plan. In practice that grounding is the NIST Cybersecurity Framework and CIS Controls.

Deliver a plan you can act on

You get a prioritized remediation plan: what to fix now, what to address over the next ninety days, and what ongoing practices to establish. I can implement it directly or support your team through it.

Keep it current

Security changes as your organization changes. A point-in-time assessment is a start, not a strategy. For teams that need continuous oversight, I provide ongoing monitoring, policy maintenance, and regular posture reviews.

Proof

Field Note

Data integrity is a security problem too

I was once hired to recover a database everyone else had written off. The corruption was as bad as anything I had seen in twenty-five years, and two major vendors had already told the organization the data was unrecoverable. I did not accept that. I extracted every record, verified completeness against the source rather than trusting the count, and proved that nothing had been left behind before anyone built anything on top of it. Security is not only keeping intruders out. It is making sure the data you depend on is intact, complete, and provably so. If you cannot prove your data is whole, you do not actually know that it is.

Proof

Advo360

The clearest proof of this standard is Advo360, my production case management platform for victim services organizations. It runs single-tenant in each client's own cloud account, enforces multi-factor authentication for every user, and holds the most sensitive information a person can hand an organization. It was built by the same hands that recovered that failed database, to a standard that assumes the worst day and holds up anyway. If it works for survivors' most dangerous information, applying it to your infrastructure is the floor.

FAQ

Typically two to four weeks depending on the complexity of your environment. You get a prioritized plan at the end, not a vague list of concerns.

Yes. Assessments and remediation plans are structured to be referenceable in grant applications and compliance reporting.

You receive a prioritized plan with real timelines. I can implement it, or you can run it with your own team. You own the plan either way.

Yes. That is one of the most common places this work starts. Environments that were set up quickly and never properly secured are exactly what an assessment is built to surface.

The cost of an assessment is predictable. The cost of not doing one is not.

Start the conversation