Frequently asked questions

SecuritySage provides simplified, non-technical cybersecurity for startups and small businesses. We help you understand your risks, put sensible protections in place and train your team, without the jargon or the enterprise price tag. Our work ranges from security audits and policy writing to phishing simulations, cloud security consulting, ongoing vCISO advice and self-paced training programs.

Yes, and usually less of it than you might fear. Small businesses are targeted because they often have valuable data and payment access but fewer defenses. A handful of well-chosen basics, such as multi-factor authentication, tested backups and staff awareness, prevents a large share of common attacks, and we focus on getting those right first.

The easiest first step is to book a free 30-minute consultation through our Get Started page at /get-started/. We will ask about your business, the systems you use and any concerns you have, then suggest practical next steps. There is no obligation and no hard sell.

Yes. Our free interactive self-assessment at /security-risk-assessment/ takes a few minutes and gives you a risk score with specific recommendations. Our blog and the plain-English glossary at /cybersecurity-glossary/ are also good places to build background knowledge before a conversation.

No. We explain everything in plain English and translate technical findings into clear business decisions. If you have an IT provider or an in-house technical person, we are happy to work alongside them as well.

We are based in Lakewood, Ohio, in Greater Cleveland. We work with clients across the United States remotely, and we offer on-site visits for businesses in the Greater Cleveland area.

Our core services are IT security audits and assessments, security awareness training, security policy development, secure infrastructure and cloud security consulting, phishing simulation and testing, and virtual CISO (vCISO) advisory. You can see the full list with details at /solutions/. Many clients start with an audit and then move to an ongoing retainer.

We review how your business uses technology, including accounts, devices, email, cloud services, network and backups, through interviews, configuration reviews and agreed technical checks. You receive a plain-English report that ranks findings by risk and gives a prioritized action plan. Our article on what happens during an IT security audit on the blog walks through each stage in more detail.

We perform technical security testing only with written authorization from someone who has the authority to approve it for the systems involved. Before any testing, we agree in writing on the scope, timing, methods and contacts. We never test systems you do not own or control, and we do not test third-party services without their permission.

Most of our work is delivered remotely, which lets us support businesses anywhere in the United States. For clients in Greater Cleveland, we can also work on-site for assessments, workshops and training days. We will recommend whichever approach gives you the best result for your project.

A virtual Chief Information Security Officer (vCISO) gives you senior security leadership on a part-time basis, without the cost of a full-time executive. It is a good fit if you are fielding security questionnaires from customers, preparing for compliance requirements, or simply want someone accountable for your security roadmap. Learn more at /solutions/virtual-ciso/.

Yes. We help small businesses understand which requirements apply to them, identify gaps and put practical security controls and policies in place. We are not a law firm, so for formal legal interpretation we recommend involving your attorney, but we work comfortably alongside legal and compliance advisors.

Our self-paced programs are digital training courses and toolkits you complete on your own schedule. They combine short video lessons with workbooks, checklists and templates, and cover topics such as cybersecurity basics, Wi-Fi and network security, security awareness, ransomware readiness, cloud security and security policies. You can browse them all at /programs/.

Programs are virtual products, so there is nothing shipped. After checkout you receive an email with access instructions, and you can also reach your programs and downloads from your account. Access is typically available immediately after payment is confirmed.

Each program includes 12 months of access from the date of purchase, including any content updates we publish during that time. Downloadable files such as workbooks and templates are yours to keep after your access period ends.

If you are new to security, start with Small Business Cybersecurity for Beginners. If you need to train your team, Security Awareness for Everyone is the best fit, and if your main concern is a specific area, choose the program focused on it, such as networks, ransomware or Microsoft 365 and Google Workspace. If you are unsure, the free self-assessment at /security-risk-assessment/ will point you toward the most relevant topics.

Yes. For team purchases, contact us through /contact-us/ and we will set up access for each learner. Each person who completes a program receives their own certificate of completion, which is useful for training records.

Yes. Our training programs include a certificate of completion once you finish all modules. The Security Policy Toolkit is a template product, so it focuses on editable documents and video walkthroughs rather than a certificate.

Consulting services are priced according to scope, so the cost depends on the size of your business, the number of systems involved and what you want to achieve. We publish starting points as From prices on /pricing/, along with our monthly retainer plans. After a free consultation we provide a written quote before any work begins.

Yes. Our retainer plans provide ongoing security support for a fixed monthly fee, with a discount when you pay annually. You can compare what each plan includes on the pricing page at /pricing/, and we can recommend the right level after a short conversation.

Yes. Once we understand your needs, we send a written proposal describing the scope, deliverables, timeline and price. Work only begins after you approve it, and if the scope needs to change along the way, we agree on that with you in writing first.

Digital programs can be refunded within 14 days of purchase as long as less than 30% of the program content has been accessed. The full details and how to request a refund are on our refund policy page at /refund-policy/. Consulting engagements are governed by the terms in your proposal.

Programs are purchased online at checkout using the payment options shown there. Consulting engagements and retainers are invoiced according to the payment terms in your proposal. If you need a specific invoicing arrangement, mention it during your consultation.

We treat client information as confidential and share it only with the people who need it to do the work. We use encrypted, access-controlled systems with multi-factor authentication, collect only what an engagement requires, and securely return or delete sensitive material when the project ends. We are also happy to sign a non-disclosure agreement before discussing details.

Only when the agreed scope requires it, and never by email or chat. Where access is needed, we prefer dedicated, time-limited accounts that you create and can revoke, rather than shared passwords. Your written authorization defines exactly what we can access and for how long.

Never. We only perform security testing with written authorization that defines the scope, timing and methods. Phishing simulations and technical tests are planned with you in advance so they are safe, fair and useful.

Stay calm, disconnect affected devices from the network rather than turning them off, and avoid deleting anything that could help an investigation. Contact your IT provider, your cyber insurer if you have one, and us via /contact-us/. For fraud or cybercrime in the United States, you can also report to the FBI's Internet Crime Complaint Center at ic3.gov.

Our privacy policy at /privacy-policy/ explains what personal information we collect through this website and our services, why we collect it and how you can exercise your rights. Our cookie policy at /cookie-policy/ explains how cookies are used on the site.