We assess your security posture, harden your infrastructure, and respond when incidents occur. Backed by 12 years of systems administration and 5 years of incident response — cybersecurity is the primary focus, and a well-built IT environment is where it starts.
Current figures from federal agencies, standards authorities, and widely cited cybersecurity research. Each source is linked so readers can review the study scope and methodology.
Coverage varies by policy. The FTC advises businesses to evaluate both first-party and third-party coverage and confirm whether a policy addresses network breaches, vendor incidents, business interruption, lawsuits, and regulatory investigations. An Ethos assessment helps document current controls and gaps; the insurer determines coverage.
CISA reports that cyber incidents have surged among small businesses that often lack dedicated defensive resources. Verizon's 2026 research likewise finds that small organizations are disproportionately affected by ransomware. The practical response is a strong foundation: inventory, MFA, patching, protected backups, logging, and a tested incident plan.
A Starter Assessment costs $2,500. FBI data for 2025 shows $3.05 billion in reported BEC losses across 24,768 complaints — a simple average of approximately $123,000 per complaint. That average is a comparison point, not a prediction of any individual incident.
Sources last verified 08-03-2026. Figures reflect each publisher's population, definitions, and methodology. Rounded values are labeled or evident from presentation.
We assess your entire security posture — identity, endpoints, network, email, backups, and access controls — and deliver a plain-language report that tells you exactly what to fix and in what order. Built on the CIS Controls framework. Designed for businesses with 1–250 employees.
Gap analysis across all critical controls — findings ranked by business impact, not technical severity.
External exposure, credential leaks, misconfigured controls, and access gaps — found before attackers do.
A prioritized action plan — 30-day quick wins and a longer-term roadmap written for business owners, not just IT.
Experienced hands when your team is understaffed during an incident — containment, evidence collection, restoration, and hardening. Remote and onsite. No forensics or data mining — staff augmentation only.
Learn more →Windows deployment, Active Directory configuration, network design, M365 hardening, and data permissions — built securely from the start so your assessment results reflect real posture, not just configuration debt.
Learn more →If your clients trust you with sensitive data — financial records, health information, legal documents — your security posture is not optional. We work with any SMB that handles sensitive data and needs a trusted security partner.
Client privilege and bar compliance require stringent data protection. We find the gaps before opposing counsel or a regulator does.
HIPAA mandates technical safeguards. We give dental offices a clear assessment of where patient data is at risk.
Advisors, RIAs, and lenders operate under FTC Safeguards Rule obligations. We map your controls against current requirements.
Tax data and financial records are prime ransomware targets. We assess your exposure and help you build a defensible posture.
Payment card data and customer PII create significant exposure. We assess POS systems, network segmentation, and access controls.
Beyond HIPAA — we assess the full technical environment including EHR access, network security, and medical device exposure.
Consultants, agencies, and service firms handling client data need solid fundamentals. We deliver practical, right-sized security.
If you have employees, data, and systems — you have risk. We work with any small or medium business ready to take security seriously.
Custom Windows builds designed for your environment — standardized, hardened, and documented. Consistent deployments mean fewer gaps and faster troubleshooting.
A clean, well-structured AD environment is the foundation of access control. Whether you are starting fresh or cleaning up years of drift, we design and harden your directory from the ground up.
A segmented, documented network is both easier to manage and significantly harder to attack. We design networks for SMBs that are right-sized, secure, and built to scale.
Uncontrolled file shares and inherited permissions are one of the most common causes of data exposure. We structure your data environment so people only have access to what they need.
Most small businesses are running M365 out of the box — with default settings that leave significant security gaps. We configure your tenant the right way from the start, or clean up what has accumulated over time.
Sometimes you need an experienced outside perspective — on a technology decision, a vendor proposal, or simply to get your environment documented before something goes wrong. We provide practical, vendor-neutral guidance.
Remote staff augmentation for teams that need experienced additional hands during an incident but travel is not yet required. Triage, containment, evidence collection, and restoration guidance — coordinated remotely with your internal IT team. No forensics or investigative analysis — hands-on operational support only.
When your team needs someone physically in the room — hands on your systems, executing containment and restoration alongside your staff. This is staff augmentation, not forensic investigation. I travel to your location and stay until the environment is contained, restored, and hardened.
You call or email. We talk through what is happening, what systems are affected, and whether remote or onsite response is the right move. This conversation is free.
We determine the scope of the incident — what was accessed, what is still active, and what needs to happen in the next hour, next 24 hours, and next week. Containment starts here.
We stop the bleeding — isolate affected systems, collect and preserve evidence, and work with your internal IT team to stabilize the environment. Remote or onsite depending on your situation.
Systems are restored to a known good state, credentials are reset, and the entry point is closed and hardened. You receive a written summary of what was done and what needs to happen next.
When an incident hits and your internal team is stretched thin, having an experienced contractor ready to step in for containment and restoration makes a real difference. This is staff augmentation — not forensics, not investigation.
Ethos Technology & Cybersecurity was founded on a simple premise: most small businesses don't need enterprise security software — they need a knowledgeable practitioner to walk through their environment, find the real risks, and tell them what to fix first. Cybersecurity is the primary focus. IT infrastructure work — Active Directory, network design, Windows hardening, M365 configuration — exists to support it.
We focus on clarity, structure, and practical improvement — not tools, hype, or overpromising. Twelve years of systems administration across Windows, macOS, and Linux — combined with five years of hands-on incident response traveling onsite to remediate breached environments — means every assessment and every deployment is shaped by real operational and security experience, not theory.
We serve businesses in Sioux City, Iowa and the surrounding region, with remote and travel engagements available nationally.
Strengthen your environment before it becomes a problem. Start with a free 30-minute discovery call — no pressure, no sales pitch.
