Vanir Strategies
Atlanta · Independent security advisory
Vanir Strategies is security advisory for small professional businesses. A free exposure scan looks at what is already public. An assessment turns that into a plan. Monthly oversight keeps watch, so client and customer data stays confidential. No software to sell, and no vendor to push.
No call required
Request an external review of the company domain. We look at what an outsider can already see and email the findings within 2 business days.
The button opens a short request form. We use the domain and email only for this review and to send the findings.
Why this matters
For a small professional business, a security failure is a confidentiality failure. Client and customer information is the work. The expensive part is rarely a headline ransom. It is time offline, a customer who leaves, and an insurance claim that pays less than the application described.
Industry figures, not Vanir client results. Sources: IBM Cost of a Data Breach Report 2025 · Verizon Data Breach Investigations Report · StrongDM SMB cybersecurity statistics, 2025.
Payroll and client work sit still while the business is offline. A customer hears there was “a data problem” and takes the work elsewhere. The carrier then compares the claim with the controls named on the application. An assessment prices that sequence in language an owner can use.
Vanir has no product line and no vendor margin. The work is an outside check on the business and on the MSP or IT provider already in place: whether what you pay for is actually operating, and which gaps that provider is not paid to surface.
The path
Three steps. The scan starts the conversation. The assessment builds trust. Monthly oversight is the engagement.
Free
Your domain, reviewed from the outside: attack surface, email authentication, and whether the business shows up in breach or ransomware victim lists. Request the scan, and we email findings within 2 business days.
Request a free exposure scan$3,500 founding
Ten to fourteen days. Leadership intake, a maturity scorecard, written findings, a 90-day roadmap, and a 60-minute call. A lite technology inventory is included. The full version, with insurance readiness and vendor risk, is $5,000.
See the assessment$1,500 / month
Automated monitoring, a plain-language monthly digest reviewed before it is sent, and alerts triaged automatically. One 30-minute call a month is the live time. Month to month.
See monthly oversightThe retainer
The assessment is a point in time. After that, the checks run on their own. You get automated monitoring and a plain-language digest, reviewed before it is sent. Alerts are triaged automatically. Live time is one 30-minute call a month, for judgment.
SSL, email authentication, attack surface, and breach and ransomware exposure. The checks run automatically.
Drafted automatically, in plain language for an owner or leadership team, then reviewed before it is sent. The cadence is monthly.
Triage is automatic. If a finding is material, you hear within 24 hours. Routine noise stays in the monitoring.
One 30-minute advisory call is the live time included. It is for judgment, not for re-running the checks. Questions between calls go by email or Slack. A further call is scheduled when an incident or a material finding needs it.
Retainer clients get a priority first call when something goes wrong. Extended response work is scoped from there.
A written posture note each quarter. The annual reassessment is included. Terms are month to month.
Technology advisory
$500 / month when it is added to Monthly Oversight. On its own, after a Tech Ops engagement, it is $1,000 / month.
This is the vCIO work: technology questions, vendor and contract review, and sourcing recommendations. Vanir evaluates. A partner can procure. Vanir does not resell the products. Sourcing and contract review live in this module.
The Security Posture Assessment includes a lite technology inventory only, capped at 15 people and 15 vendors. A full Tech Ops review — spend, contracts, redundancy, and the staffing model — is its own paid engagement.
AI advisory
$750 / month added to Monthly Oversight, or $1,000 / month on its own, after a Secure AI Assessment or an AI Operating Sprint. See the AI section.
Ten to fourteen days
A plan you can run. Leadership intake, an outside-in review, and a roadmap in business language. Your team’s time is the intake and a 60-minute call at the end.
How the business handles client and customer information, access, vendors, and incidents. No technical translation required from you.
Attack surface, email authentication, and a breach and ransomware-list check — the same public facts an outsider can collect.
A maturity scorecard and a written report: the gap, the consequence, and the order to address it.
Prioritized by risk and effort, so the next quarter has an order of work rather than a pile of findings.
Findings, priorities, and a clear recommendation on Monthly Oversight. The call is a walkthrough, not a software pitch.
Beside the main path
Use the tools. Do not paste client or customer data into public AI. That information is confidential, the same as the rest of what the business holds for them. These offers sit beside the scan, the assessment, and monthly oversight.
+$1,250
Added to the Security Posture Assessment. It covers how people already use AI tools, which client or customer facts could leave the business, and what a usable policy looks like.
$4,000 founding
A short project after the Secure AI Assessment, or scoped directly from that add-on. It sets what the business may use, what stays out of public tools, and who is accountable — then points at monthly AI advisory.
+$750 / month
Ongoing judgment on AI use after an assessment or a sprint. $750 / month on Monthly Oversight, or $1,000 / month on its own.
Who it is for
Professional services, law practices, fintech and financial services, and other small organizations where customer information is confidential.
Professional services
Files, email that can be spoofed, and vendors who touch the data. Confidentiality is part of the work. The scan starts with the domain. The assessment maps that duty onto how the business actually operates.
Financial services
Payments, fintech, and the control questions that show up in GLBA, PCI DSS, and carrier applications. The same outside-in method applies.
Healthcare, insurance, and other regulated organizations use the same oversight. A law practice sits in that same group.
The advisor
You get the judgment of a senior security executive who has sat in the chair, with no software catalog attached to the advice.
The free exposure scan is a request. We review the domain from the outside and email findings within 2 business days. On the retainer, monitoring, monthly digests, and alert triage run automatically. A digest is reviewed before it is sent. Live time stays scarce on purpose: the monthly call, and judgment when a finding is material. What you read is the risk, the consequence, and the next step.
When a finding calls for implementation, that work is scoped from the engagement. An MSP or another specialist can execute it. Vanir can coordinate when you want an independent owner on the plan. Extended incident response, beyond the retainer’s first call, is $375 an hour with a 10-hour minimum.
The Vanir
In Norse tradition the Vanir are associated with wisdom, prosperity, and foresight — counsel sought before a decision of consequence. The mark on this site is a Vegvisir, a wayfinding compass. The practice is built the same way: look ahead, then choose.
Common questions
The exposure scan is free. The Security Posture Assessment is $3,500 on founding pricing, or $5,000 for the full assessment with insurance readiness and vendor risk. The Secure AI add-on is $1,250. Monthly Oversight is $1,500 per month on founding pricing, month to month, for a cohort of three. The AI Operating Sprint is $4,000 founding for businesses of up to 10 people. AI Advisory is $750 per month on the retainer, or $1,000 per month on its own. Technology advisory is $500 per month on the retainer, or $1,000 per month on its own after a Tech Ops engagement.
The assessment includes a lite technology inventory, capped at 15 people and 15 vendors. A full Tech Ops review — spend, contracts, redundancy, and the staffing model — is a separate paid engagement. Ongoing technology advisory is the module at $500 per month on Monthly Oversight.
One 30-minute advisory call. That is the standing live time. Monitoring, the monthly digest, and alert triage run automatically. The digest is reviewed before it is sent. Async questions by email or Slack are included. Another call is scheduled when an incident or a material finding needs a live conversation. It is not a second standing meeting.
Keep them. Vanir is the outside check: whether the setup matches what you are paying for, and which gaps are easier to miss from inside the contract. There is no product to swap in underneath them.
The policy pays after an incident, on the terms you actually meet. Claims get reduced when the application described controls that were not in place. The full assessment maps readiness against that gap before a claims conversation does it for you.
If you have cyber insurance, call the carrier’s breach line first. Many policies expect early notice. Retainer clients get a priority first call from Vanir. Extended incident response for anyone else is $375 an hour with a 10-hour minimum, and is often covered by the policy.
Small professional businesses that hold client or customer information: law practices, other professional services, fintech and financial services, and similar regulated work. The founding cohort is three small professional businesses.
Founding cohort
Request a free exposure scan. We review the domain from the outside and email findings within 2 business days. If that is enough to justify a deeper look, the assessment is 10–14 days and ends with a recommendation on monthly oversight.
Channel
Offer clients an independent security check while you keep the IT relationship. Vanir stays vendor-neutral: advice, not a tool catalog, and no vendor margin on what you sell.
AI pricing for the channel is unpublished until a direct AI advisory retainer is in place.
Partner program inquiry| Monthly oversight invoice | $3,000 per month, flat. This is the channel retainer. |
|---|---|
| Assessment, client billed | $4,500 |
| Assessment, Vanir invoice | $3,000 |
| Assessment margin you keep | You keep $1,500 of the assessment fee. |
Channel terms are separate from direct-client pricing published above. Implementation for channel clients stays with the partner. Vanir advises.