Services

Small, specific, and documented.

Every engagement ends with a document you can file: what was observed, what changed, and what remains. No subscriptions you cannot cancel, no dashboards you have to learn.

Engagement at a glance

Scope       1 host, named in writing
Change      version bump + verification
Fee         fixed, agreed before work
Deliverable 2–4 page report

Four ways to work together

Start at the top. Most relationships do.

Version attestation Free

I make one request to a public page, record the software version your site advertises, and match it against the current advisory. The deliverable is a one-page attestation: observed build, applicable advisory, fixed build, and the exact command your staff can run to confirm it themselves.

It states plainly that no scan, login, or test occurred. If your site does not advertise a version, the attestation says so rather than guessing.

No cost · 1–2 business days · one page, PDF

Fixed-fee remediation

The actual change, done under a signed scope: staging test where one exists, a scheduled window, a rollback plan, and before-and-after evidence. Where the site is on shared hosting, this is usually a control-panel version change — and I will say so, because quoting a project for a dropdown wastes your money.

If your staff would rather make the change themselves, the report includes the exact menu path and the verification steps. You can keep the fee and do the work.

Typical $750–$2,500 per host · 3–10 business days

Quarterly patch cycle

A named person checks your public services on a schedule, applies or schedules the updates, and sends a report each quarter that states what changed and what did not. Includes a rollback plan and a defined escalation contact.

This is the product most organizations actually need. A one-time fix drifts back the moment nobody is looking, and a quarterly report is what gives a budget line something to point at.

Typical $150–$500 per month · cancel with 30 days' notice

IT consulting

The work around the work: hosting migrations, infrastructure and account reviews, vendor evaluation, written documentation of a system that only one person understands, and backup restores that have been tested rather than assumed.

Useful when a small organization has outgrown its setup but does not yet have anyone whose job is to own it.

Hourly, or fixed scope after a call

For agencies and MSPs: white-label per-site patching is available at $50–$150 per site per month, delivered under your brand with your client as the signatory.

What things cost

Ranges, not quotes. The fixed fee is confirmed in writing after a scope call, before any work begins.

Typical engagement sizes. Government and nonprofit rates are the same; the difference is paperwork.
Engagement	What you get	Typical fee	Turnaround
Version attestation	One-page statement of observed build and applicable advisory. Not a scan.	$0	1–2 days
Panel version change	Shared-hosting version bump, staging check where available, verification.	$250–$450	2–5 days
Remediation, one host	Full remediation with rollback plan and before-and-after evidence.	$750–$2,500	3–10 days
Quarterly cycle	Monthly checks, quarterly report, named contact, rollback plan.	$150–$500/mo	Ongoing
End-of-life migration	Moving off an unsupported runtime or CMS, including compatibility work.	Quoted	2–6 weeks
Agency / white-label	Per-site patching under your brand, your client signs the scope.	$50–$150/site/mo	Ongoing

Public entities: I can supply a W-9 and a certificate of insurance through my broker, complete vendor registration, and invoice against a purchase order. Small purchases often fall under your bid threshold, which keeps the first engagement simple.

What I need from you

Who owns it: The organization that owns the site, and the person authorized to approve work on it. If an agency or MSP hosts the site, they are the client, not the town.
The domain: The exact hostname or hostnames in scope. Anything not listed is out of scope, including subdomains, staging environments, and mail servers.
Access: Control-panel or shell access, or a staff member who can run commands and paste the output. Either works; the second is often faster.
A sign-off contact: One person who can accept the deliverable. Reports addressed to a committee tend to sit unread.

What is not included

Being clear about the edges is part of the service.

No 24/7 monitoring or incident response. This is a one-person practice with defined hours. If you need round-the-clock coverage, I will say so and point you elsewhere.
No compliance certification. I can produce evidence that supports an audit; I cannot certify you as PCI, HIPAA, or CMMC compliant, and anyone who offers to in a single engagement is selling you a document, not a control.
No production penetration testing under this scope. Destructive or intrusive testing is a separate engagement with its own authorization and, for public entities, its own procurement.
No software resale, no affiliate commissions. Recommendations are not paid placements.

Not sure which one you need?

Ask for the free attestation. If the answer is “your host updated this in 2024, you are fine,” that is the whole reply, and it costs you nothing.

Request an attestation Read the sample scope