The October 2026 Brief · The schedule of engagements

Services · The schedule of engagements

For law firms and medical practices that want the scope, the fee and the end date on one page.

Four engagements, each fixed in scope and priced between $400 and $1,500. Nothing below is an opening bid. The figure beside each engagement is the figure on the invoice, and the scope beneath it says, plainly, what we will put our hands on — and what we won’t.

Part one · The schedule

Each engagement, read in full

Security firms tend to withhold prices until a salesperson has you on the phone. We would rather you arrive at the call already knowing whether you can afford us — and which of the four you actually need.

The Inbox Check

$415 fixed
  • DurationFive business days
  • AccessRead-only
  • Delivered asA four-page memo
Scope the Inbox Check

The smallest useful look at the place most small-practice breaches begin: the inbox of whoever approves payments.

What we read

  • Every forwarding and inbox rule, mailbox by mailbox
  • MFA registration — who has it, who skipped it, and by what method
  • Every account holding Global or Exchange admin
  • Thirty days of sign-ins, filtered for unfamiliar countries and impossible travel
  • Third-party apps granted permission to read mail

What lands on your desk

  • One page of findings in plain English, three of evidence
  • A short list of fixes your IT provider can make the same week
  • A fifteen-minute call to walk through the memo

Outside this scope

  • Changing any setting — that’s Hardening
  • Laptops, backups and vendors — that’s the Audit
Best when

A wire nearly went astray, a client mentioned an odd email “from you”, or you simply want to know where you stand before committing to anything larger.

Phishing-Resilience Training

$685 up to 20 staff
  • DurationAbout six weeks, two campaigns
  • Live session45 minutes, by video
  • Larger teamsQuoted on the call, within $1,500
Schedule a campaign
Isometric illustration of a front desk where an envelope tied to a small brass fishhook sits on the keyboard
Plate III. The convincing ones arrive at 4:50 p.m., signed by someone you know.

Training that sounds like your post room, not a compliance module bought in bulk.

What we run

  • A baseline campaign written in the voice of your real correspondents — court e-filing notices, lab and pharmacy portals, insurers, a partner’s “quick favour”
  • A live session built from what your own staff actually clicked
  • A second campaign thirty days later, harder than the first
  • A report-phishing button in Outlook, so suspicion has somewhere to go

What lands on your desk

  • Results by role, never by name — we don’t publish who clicked
  • The session recording, for every new hire after
  • A one-page procedure for verifying any change to payment details

Outside this scope

  • Annual completion certificates for a filing cabinet
  • Disciplinary recommendations about individual staff
Best when

Your staff are conscientious and busy — which is exactly the combination a well-made phishing email depends on.

The Remote Security Audit

$1,175 fixed
  • DurationAbout two weeks
  • Walkthrough45 minutes, recorded
  • Mapped toHIPAA or your bar’s rules
Commission the audit

A considered read of the whole office, measured against what the HIPAA Security Rule and your duty of technology competence actually ask — not a vendor’s checklist.

What we read

  • Microsoft 365 configuration, from tenant settings to mailbox auditing
  • Laptops and desktops — encryption, updates, local admin rights
  • Backups, including a restore test of one real file
  • Password and MFA habits, shared logins among them
  • Vendors with remote access: EHR, case management, billing, the copier

What lands on your desk

  • A one-page summary for the partner or physician-owner
  • A ranked remediation list, cheapest-and-most-urgent first
  • Findings mapped to HIPAA §164.308 and §164.312 safeguards, or to your bar’s confidentiality and competence rules
  • A technical appendix written for your IT provider

Outside this scope

  • Penetration testing or attempted exploitation
  • Fixing what we find — that’s Hardening, or your IT provider
Best when

The insurer’s renewal questionnaire has arrived, a new partner is joining, or nobody in the office can say when the backups were last restored.

Microsoft 365 Hardening

$1,460 fixed
  • DurationSeven to ten business days
  • AccessNamed guest administrator
  • Handover30 minutes, with your IT provider
Lock down the tenant
Isometric illustration of a cloud built like a brass strongroom, its small doors being padlocked beside an open ledger
Plate IV. Every door we close is written into the change log, with the key to reopen it.

Where the Audit describes the doors, Hardening closes them — inside your Microsoft 365 tenant, with a record of every setting we touch.

What we change

  • Conditional Access policies, with a sealed break-glass account
  • Legacy authentication switched off
  • Defender anti-phishing, Safe Links and Safe Attachments, where licensed
  • Data-loss rules for Social Security numbers, PHI and account numbers
  • Automatic external forwarding blocked; guest and sharing defaults reined in
  • Audit-log retention extended

What lands on your desk

  • A dated change log, setting by setting, with how to reverse each
  • Before-and-after Microsoft Secure Score screenshots
  • A short note for staff on what will feel different on Monday

Outside this scope

  • Licence purchases — we tell you if one is needed; you buy it from your provider
  • Google Workspace or on-premises Exchange
Best when

An Inbox Check or an Audit has named the problems, and you want them closed by someone who has already read the tenant.

Part two · Choosing

Which file answers which worry

Read across from whatever keeps you up at night. A filled square means the engagement was built for it; an open square means it touches the problem on the way past.

Swipe the table sideways to see all four engagements.

The worry No. 01Inbox Check$415 No. 02Training$685 No. 03Audit$1,175 No. 04Hardening$1,460
A client wire or settlement payment was nearly diverted
Staff click on things they shouldn’t
Nobody can say who holds admin
We need documented, reasonable safeguards on file
The cyber-insurance renewal asks about MFA and backups
A partner or physician is leaving with access intact
We’d like an honest answer for $415, and to decide the rest later

Where two columns tie, start with the cheaper one. The scoping call exists partly to talk you out of what you don’t need.

Part three · Where we look

A law office and a clinic leak in different places

The engagements are the same on paper. The reading is not. A family-law firm and a dental practice keep their secrets in different drawers, and the people trying to open those drawers know it.

For counsel

In a law office

  1. Wire instructions sent by emailThe single most expensive habit in small-firm practice, and the first thing we look for.
  2. E-filing and court-notice impersonationLures that borrow the clerk’s formatting and arrive the morning of a deadline.
  3. Shared drives left open after a matter closesOpposing counsel, experts and clients with links that never expired.
  4. Contract paralegals and of-counsel accountsAccess granted for one case and still live three cases later.
  5. Trust-account approvals routed through one inboxWhere a single compromised mailbox becomes a diverted disbursement.

Read against your duty of technology competence and your obligation to protect client confidences.

For practitioners

In a clinic

  1. Fax-to-email gatewaysConfigured years ago, still delivering referrals and lab results to an inbox nobody audits.
  2. EHR vendor remote support, permanently onConvenient for the vendor; a standing door for anyone who borrows their credentials.
  3. Shared logins at the front desk and in exam roomsWhich make every access log a guess about who was really signed in.
  4. Impersonated portal and lab notificationsThe emails patients and staff are trained to open without a second look.
  5. Locums and per-diem staffAccounts that outlive the shift by months.

Read against the HIPAA Security Rule’s administrative and technical safeguards.

Part four · The fine print, printed large

What every engagement promises, and what none of them do

These terms sit above all four engagements. They are short because we’d rather you read them than skim them.

Ask about the terms

  1. The fee does not move.

    Quoted in writing within two business days of the scoping call. That figure is the invoice, whatever we find.

  2. Billed in two halves.

    Half at kickoff, half on delivery of the report, payable by card or ACH.

  3. Access is borrowed, then returned.

    Delegated, visible in your own admin centre, and removed the afternoon we deliver — with written confirmation.

  4. Live trouble comes first.

    If something is already happening, scheduled work stops and you get a call within the hour, with containment steps in hand.

  5. We sell nothing else.

    No hardware, no licences, no monthly monitoring contract waiting at the end of the report.

  6. We certify nothing.

    You get documented, reasonable steps on file. Anyone certifying an office in a fortnight is selling the certificate.

  7. Your IT provider stays.

    We are a second pair of eyes. The appendix is written for them, and they’re welcome on every call.

  8. Remote, always.

    Nobody sits in your waiting room. Your clients and patients never learn we were there.

Part five · Opening a file

Twenty minutes, then a fixed quote in writing

Tell us what you hold and who can reach it. We’ll name the engagement that fits — or tell you, plainly, that you don’t need one of ours yet.

Book the twenty-minute call

or write to connect@thornburyhale.com

Book the twenty-minute call