The quote is the invoice
You see the fixed fee before you sign, and it’s the number you pay. Extra seats are priced up front, never discovered later.
About · Macon St, Brooklyn
Kettle on, shared inbox open, and someone finally says: “Let’s fix this properly.”
That’s the moment we work for. Fernwood Security is a small Brooklyn crew that takes the scary, jargon-heavy side of cybersecurity and turns it into a fixed fee, a plain-English report, and a team that feels ready.
- Plain English
- Fixed fee
- Read-only access first
- Fix lists, not fear
- Pilot before rollout
- Brooklyn, NY
01 · Why we exist
Big-company protection, sized for a team of six
Most security firms are built for companies with a security department. You have an office manager, a bookkeeper, and a very full calendar. We started Fernwood to work for the people who actually run small businesses in Brooklyn.
So we do three things and do them well: test how your team handles phishing, harden the Microsoft 365 or Google Workspace you already pay for, and write down exactly what happens when something goes wrong.
Every engagement has one fixed fee, one invoice, and one report written for the person who signs it. You’ll know what we found, what to fix first, and how long it takes. Then you do it — and that feels good.
02 · How an engagement unfolds
Ten business days, one clear arc
Here’s the rhythm of a phishing-resilience audit. Hardening and response plans follow the same spirit: scoped first, explained as we go.
Day 1 · Kickoff
We agree the scope — in writing
Seats, tools, and the one thing keeping you up at night. You get the fixed quote before anything starts.
Days 2–3 · Access
Read-only, temporary, yours to switch off
You grant a read-only admin role. We never hold the keys, and you revoke the role when the report lands.
Days 4–7 · The test
A consented phishing round and a mail-setup check
Your team knows a test is coming, not when. We review SPF, DKIM and DMARC alongside it.
Days 8–10 · The report
A ranked fix list in plain English
Findings sorted by effort and impact, plus a walkthrough call so nobody is left decoding it alone.
03 · What we promise
Four commitments on the wall by our door
You stay the owner
Your accounts remain in your hands. Our access is read-only, temporary, and ends when you say.
Pilot before rollout
Every change is tried on one test account first, then your team gets a thirty-second heads-up note. No mid-day lockouts.
Findings you can act on Tuesday
Every item says what to do, who can do it, and how long it takes. If a step needs a specialist, we say so plainly.
04 · Our lane
What we do — and what we’ll point you elsewhere for
Knowing our lane is how we stay fast and fairly priced.
In the Fernwood lane
- Phishing-resilience audits for teams up to 15 seats
- Microsoft 365 and Google Workspace hardening
- Written incident-response plans and a one-page wall card
- A first-three-steps call if something already looks wrong
Outside it
- Running your day-to-day IT help desk
- Selling you software you don’t need
- Scare-tactic reports padded with jargon
- Open-ended contracts that keep billing after the work is done