The October 2026 Brief · About the practice
Thornbury & Hale is a deliberately small security practice. We audit, harden and train remotely, on fixed fees between $400 and $1,500, and we write everything we find for the person whose name is on the door — not for the person who installed the router.
Opening new files · scoping calls Mon–Fri, 11am–6pm Eastern
Cybersecurity, as it is usually sold, is sized for companies with a security department. The eight-person practice gets the leftovers: an enterprise product it can’t configure, or a monthly contract to watch a dashboard nobody opens.
Thornbury & Hale was set up on the opposite assumption — that a family-law firm off Commercial Boulevard or a two-physician clinic on University Drive deserves the same scrutiny as a hospital, delivered at a scale and a price that fits the office. Not a shrunken version of enterprise security; a different shape altogether.
That shape is narrow by choice. We do three kinds of work — audits, phishing-resilience training and Microsoft 365 hardening — because those three track the way small practices actually lose data: a borrowed password, a convincing email, a tenant left on its factory defaults. We would rather do three things thoroughly than twelve things vaguely.
We also decided early that the report is the product. An audit only an engineer can read changes nothing in an office run by attorneys and physicians. So every report opens with a single page in plain English — what we found, what it would cost you, what to do on Monday morning — and the technical appendix follows for whoever keeps the machines running.
And we decided that discretion would be structural rather than promised. Access is delegated through your own admin centre, logged where you can see it, and removed the afternoon the work is done. Your clients and patients should never learn that we were there. That is rather the point.
Every engagement letter we send repeats these seven clauses. They are the reason the practice stays small, and the reason it stays quiet.
Your quote arrives within two business days of the scoping call. It doesn’t move once signed, and it never exceeds $1,500.
We look before we touch. Write access is requested for named changes only, and each one appears in a log you keep.
Plain English for the partner or physician-owner; screenshots, settings and scripts in the appendix for IT.
Our guest access is removed the day the report lands, with written confirmation for your file.
No hardware margins, no licence commissions. If a product appears in your report, it’s because your office needs it.
We copy them on the walkthrough and write the appendix for them. A second opinion, never a replacement.
Medical practices receive a Business Associate Agreement before access is granted; law firms, a confidentiality undertaking drafted with privilege in mind.
Seven clauses. Twenty minutes on the phone to see whether they suit your office.
Book the twenty-minute callEvery engagement crosses two desks: one that reads your systems, and one that writes them up. The same pair carries your file from the scoping call to the afternoon access is revoked — nobody new appears halfway through.
Sign-in logs, mailbox rules, Conditional Access, device encryption, backup restores, and every vendor with a standing connection to your data. Read inside your tenant — never exported to ours.
Turns findings into an argument a managing partner can follow: what it is, what it risks, what it costs to fix, and in which order. Edited the way you would edit a brief.
Curious how your own office would read on both desks?
Book the twenty-minute callSome of what the industry sells small practices, we decline on principle. Better you read it here than discover it on the scoping call.
Most small-practice breaches arrive by login, not by port. We fix the login.
You receive a report with an end date, not a subscription to anxiety.
We write when your file needs it. Otherwise, silence.
Revoked the day the work ends. If you need us again, you invite us again.
No honest firm can certify an office that quickly. We document reasonable, defensible steps instead.
Everything happens over a scheduled screen share. Your patients and clients see nobody new.
Twenty minutes, no slides. Tell us what you hold and who can reach it; within two business days you’ll have a written scope and a fixed fee between $400 and $1,500.
or write to connect@thornburyhale.com
| Practice | Thornbury & Hale — security for law firms and medical practices |
|---|---|
| Office | 8500 Nw 51St Court Lauderhill, FL 33351Find the Lauderhill office on a map |
| Hours | Mon–Fri 11am–6pm Eastern |
| Telephone | (954) 753-4404 |
| Correspondence | connect@thornburyhale.com |
| Fees | $400–$1,500 per engagement, fixed in writing |
| Settled by | Card or ACH, invoiced in two halves |