This library is for owners, managing partners, IT managers, and compliance leads at small and midsize organizations who have to make security and AI decisions without a security department. Everything here is free, ungated, and written to be used in a meeting rather than filed away.
Start With Your Baseline
Most organizations cannot say which controls they actually have. Two short checks fix that in about ten minutes. Neither asks for an email address, and neither stores your answers.
- Cybersecurity self-assessment — twelve questions across identity, patching, backup, endpoint, email, and response. You get a score, the domains that scored lowest, and three actions to start with.
- AI readiness check — ten questions on ownership, data rules, vendor terms, human review, and testing. Use it before you scale a pilot, not after.
Topic Guides
Three long-form guides cover the questions we answer most often on client calls. Each one includes the controls, the evidence, and the order to do the work in.
- Small business cybersecurity — the ten controls that prevent most of the damage, what a breach actually costs, and a 90-day plan you can hand to your IT provider.
- AI for business — where AI pays off first, the security questions to ask before any tool is approved, and how to measure return instead of guessing.
- Compliance — NIST, HIPAA, PCI DSS, and ISO 27001 in plain language: who each framework applies to, what evidence looks like, and where our role stops.
Templates and Checklists
The incident response plan template is a printable outline with the sections that matter when something is already going wrong: roles and contacts, critical systems, the first 24 hours, evidence handling, communications, recovery, and the post-incident review. Fill it in before you need it, then test the contact tree twice a year.
Industry Guides
Two sectors generate most of our incident work, for specific reasons: client confidentiality and privilege obligations in legal, and patient data plus clinical uptime in healthcare.
- Cybersecurity for law firms — client confidences, business email compromise, document systems, and what a firm assessment actually changes.
- Cybersecurity for healthcare — HIPAA risk analysis, EHR downtime, connected devices, and ransomware recovery.
Recent Insights
- The Threat Floor: Cybersecurity for Small and Medium Businesses in 2026
- The First 72 Hours After a Cyber Incident
- Shadow AI: When Employees Put Company Data Into ChatGPT
- 2026 AI Security Briefing
- Costs and Risks of Data Breaches: What the IBM Report Shows
- The Importance of Multi-Factor Authentication
More analysis lives in the insights archive, indexed by topic.
Where to Go Deeper
Each guide ends with the service that does the work: cybersecurity assessment, incident response, compliance and gap analysis, and AI consulting and AI security. Rates are published in the service menu.
Talk to an Engineer
If a check or a guide raises a question you cannot answer internally, call 703-486-0200 or use the contact form. We reply within one business day, and the first consultation is free for up to an hour. You get a written scope and estimate before any billable work begins.
Schedule a free consultation Run the self-assessment