Protect
Email, identity, endpoint, and Microsoft 365 controls, MFA, verification, approved AI tools, data controls where your licensing supports it, and note-taker lockdown.
How we work
We run security. Your team gets clear rules.
AI helps your office move faster, and it creates moments that need a clear rule. We run Protect, Recover, Test and fix, and Prove beside your IT, so partners know what's covered and who moves next.
Verification in practice
When a convincing request arrives.
A "client," vendor, bank, software provider, or partner asks for money, documents, or a login by email, text, or phone. Your team already knows the steps.
Illustrative examples.
- Hang up and call back on a number already on file.
- Use the pre-agreed passphrase or check.
- Get a second approver above the amount your firm sets.
- Send returns, W-2s, and 1099s only to a verified contact. Never reset a login or approve an MFA prompt because a caller asked.
- Treat pressure, like "text me on my cell instead," as a stop sign.
- Report it to us so we can check for related activity.
Built on published FBI and FinCEN guidance and practiced with your team. A convincing fake call is not enough to move money.
Staff AI use
Your team uses AI. Client data stays put.
The risk is a return pasted into a free chatbot, or a note-taker storing a client call somewhere nobody vetted.
- Approved tools: agreed with the partners.
- Data controls: client data kept out of unapproved tools, where your licensing supports it.
- Note-takers and apps: new bots and connected apps in Microsoft 365, Teams, and Zoom need approval.
- Policy and sign-off: a plain AI use policy staff sign, plus a register of AI tools in use.
With your IT
Your IT runs the business. We run security.
- Your IT: infrastructure, user support, and day-to-day admin.
- Double Rule: the security program and controls. No helpdesk, device repair, or general IT.
- Partners: own the WISP and regulatory designations. We build, run, and evidence the controls behind them.
- No IT provider? We'll help you find one or work beside whoever handles your computers.
How the program runs
01
02
03
04
Protect. Recover. Test and fix. Prove.
Recover
Backup coverage review, restore checks on agreed critical systems, and an incident response plan for ransomware, takeover, and AI scenarios.
Test and fix
Continuous Security Validation and lookalike-domain watch, with findings tracked to closed. Full pentests scoped separately.
Prove
WISP, AI use policy, sign-offs, AI tool register, monthly note, and quarterly partner summary.
How firms engage
Snapshot. Foundation. Baseline. Managed.
Snapshot: free, passive, run by Avery.
Foundation: paid entry, with your first AI defenses.
Baseline: your roadmap turned into action.
Managed: the full program, every month.
Filing season
Busy season is when urgency works for attackers.
Deadlines and seasonal staff make rushed requests easier to push through. We refresh verification and phishing awareness before peak, hold big changes until after where practical, and still fix urgent risks.
Reporting
Plain reporting for partners.
- Monthly operations note: what we ran, what changed, what's open.
- Quarterly partner summary: risk, remediation, AI tool use, and decisions needed.
Your named contact
Problems rarely arrive with a clean label.
A strange payment request or suspicious login can involve several providers at once. Avery, your named contact in business hours, pulls in the right people and keeps ownership clear.
Free Security Snapshot
What the Snapshot covers.
A light, passive review of what's public about your firm, run by Avery. No credentials, nothing installed, no intrusive testing, and not a penetration test.
Fees
Fees set before work begins.
Foundation is one-time; Managed is annual, delivered monthly. Software and specialty work are priced separately, and we don't publish a price list.
Get a Free Security Snapshot.
Avery will tell you what stood out and whether Foundation makes sense.