Assess
Three-minute readiness snapshot: gaps, stage, and a recommended Salvus path.
Built for
- Law firms
- Financial advisory
- Medical & dental
2018
Founded
$0
Setup fees
24hr
Response SLA
6
Service tiers
The reality for professional firms
Most firms are one bad Monday away from a crisis.
No security leadership. No tested backup. No one to call when something looks wrong. Salvus Cyber gives professional firms the security program they were told only enterprises could afford: senior-led, fixed-price, in plain English.
$9.8M
Average healthcare breach cost in 2024, the highest of any industry.
$1.27M
Average ransomware recovery cost for SMBs, plus weeks of downtime.
200+ days
Average undetected breach time without active monitoring.
What we do
Six services. Fixed prices.
Every engagement is delivered by a senior practitioner, not a ticket queue.
Security Risk Assessment - from $3,500
A complete look at where you stand: email and access controls, backups, vendor exposure, and your written policies. You get a findings report ranked by risk, a remediation plan in plain English, and a written information security plan your cyber insurer and your clients will ask for. Fixed scope, fixed price, delivered in two to three weeks. Findings report in 3 weeks or the assessment is free.
Fractional vCISO - from $2,000/month
Your security program, run for you. Quarterly policy reviews, vendor security checks when you sign new software, annual staff training and a tabletop exercise, and a senior practitioner on call when something happens. The coverage of a security department for less than the cost of one hire.
Penetration Testing - from $7,000
We test your defenses before criminals do: external network, web applications, and cloud. You get a findings report with evidence for every issue, a retest after you fix them, and a report you can hand to clients or your insurer.
AI Use Risk Review - from $5,000
Attorneys and advisors are feeding client data into AI tools with no policy behind it. The review inventories how AI is actually used across your firm, tests the data exposure and confidentiality risk, and delivers a written AI use policy and guardrails mapped to bar guidance and SEC expectations.
Managed Security Awareness - $45 per seat/year
Your people are the first target in almost every attack on a firm like yours. Salvus runs ongoing phishing simulations and short, role-based training for your staff, including safe AI use, and gives your partners reporting they can hand to the cyber insurer at renewal. A $1,500 annual minimum applies.
Incident Response Retainer - from $5,000/year
When something looks wrong, your firm skips the paperwork and goes straight to a senior practitioner. The retainer puts engagement terms in place before anything happens, prepares your written incident response plan in advance, and runs an annual tabletop exercise, so the first bad hour is not improvised. Response work itself is billed at a pre-agreed hourly rate.
Compliance and client trust
Required by regulators. Asked for by clients.
Written documents and programs your firm can hand over: the plans, policies, and risk analysis regulators require, plus support for the security questionnaires your clients send.
Written Information Security Plan (WISP)
The written plan the FTC and IRS require of accounting and tax firms.
HIPAA Risk Analysis
The documented risk analysis medical and dental practices are required to maintain.
SEC Regulation S-P Policies
The written safeguards and incident response policies Regulation S-P requires of covered advisory firms, ready to hand to an SEC examiner.
Client Security Questionnaire Support
Clean, evidence-backed answers when your clients audit your security.
Where we specialize
Built for firms that live on client trust
Law firms, financial advisory, and medical and dental practices are where we go deepest. A great client in another industry is still a great client.
Law Firms
You hold deal data, litigation strategy, and client confidences. The bar expects you to protect them. We make that practical.
Accounting & CPA
Client financial data protection, through tax season and beyond.
Financial Advisory
The SEC expects a real cybersecurity program, not good intentions. We build one that stands up to an exam.
Medical & Dental
Patient data with HIPAA expectations, on a practice-sized budget.
SMBs & Mid-Market
5 to 100 staff firms that handle sensitive data and need real security leadership.
Nonprofits
Mission-driven organizations deserving the same quality of protection.
How it works
Assess, scope, protect
A clear path from first visit to a written quote. No black-box pricing.
Scope
Short call to validate findings against your real environment and priorities.
Protect
Written quote, clear SLA, and senior-led delivery, no ticket-queue runaround.
SALVUS CYBER
How Salvus works
Senior-led delivery
Houston · Est. 2018
Why Salvus Cyber
Senior practitioners on every engagement
Salvus Cyber is practitioner-led and confidential by design. Every engagement is run by a cybersecurity operator with 10+ years in security leadership, backed by a Master's in Cyber Operations and industry certifications including GCFE, GCIH, AWS Certified Security - Specialty, CEH, CompTIA CySA+ and Security+, Microsoft SC-200, and Splunk. No junior handoffs, no vague retainers, no jargon.
- 10+ years in cybersecurity leadership
- Master's in Cyber Operations
- GCFE · GCIH · AWS Security Specialty · CEH · CySA+ · Security+ · SC-200 · Splunk
Law firmsFinancial advisoryMedical & dental
About Salvus Cyber Service packages
Six paths, one scoping process
Fixed pricing. Senior-led. No vague retainers.
Typical investment
Fixed-price engagements from $3,500
Fixed scope, fixed price. The assessment comes first: findings report in 3 weeks or it is free.
From $3,500
Security Risk Assessment
Know exactly where you stand.
One-time engagement · 2 to 3 weeks
A complete look at your email and access controls, backups, vendor exposure, and written policies. You get a risk-ranked findings report, a remediation roadmap in plain English, and a written information security plan. Findings report in 3 weeks or the assessment is free.
- Risk-ranked findings report
- Remediation roadmap in plain English
- Written information security plan
- Fixed scope, fixed price
From $2,000/month
Fractional vCISO
Your security program, run for you.
Monthly engagement
Quarterly policy reviews, vendor security checks when you sign new software, annual staff training and a tabletop exercise, and a senior practitioner on call when something happens. The coverage of a security department for less than the cost of one hire.
- Quarterly policy reviews
- Vendor security checks
- Annual training + tabletop exercise
- Senior practitioner on call
From $7,000
Penetration Testing
Tested before criminals do it.
Scoped engagement · retest included
External network, web application, and cloud testing with a findings report backed by evidence for every issue, a retest after you fix them, and a report you can hand to clients or your insurer.
- External, web app, and cloud scope
- Evidence-backed findings report
- Retest after remediation
- Insurer- and client-ready reporting
From $5,000
AI Use Risk Review
Know what your AI use is exposing.
One-time engagement · policy included
An inventory of how AI is actually used across your firm, findings on the data exposure and confidentiality risk it creates, and a written AI use policy with guardrails mapped to bar guidance and SEC expectations.
- Firm-wide AI use inventory
- Data exposure and confidentiality risk findings
- Written AI use policy and approved tool list
- Guardrails mapped to bar and SEC expectations
$45 per seat/year
Managed Security Awareness
Training your people will actually finish.
Annual engagement · $1,500 minimum
Ongoing phishing simulations and short, role-based training run for your firm by Salvus, including safe AI use, with reporting your partners can hand to the cyber insurer at renewal.
- Monthly phishing simulations
- Short role-based training modules
- AI use awareness included
- Insurer-ready reporting
From $5,000/year
Incident Response Retainer
Someone senior to call when it goes wrong.
Annual retainer · terms set in advance
Engagement terms signed before anything happens, a written incident response plan, an annual tabletop exercise, and priority access to a senior practitioner. Response work is billed at a pre-agreed hourly rate.
- Engagement terms signed in advance
- Written incident response plan
- Annual tabletop exercise
- Priority access to a senior practitioner
See how quotes work : assessment first, written scope before you commit.
Why Salvus Cyber
Different by design
01
Senior-led, always
A senior practitioner runs your engagement personally. No ticket queue, no junior handoffs.
02
Fixed price, plain English
Fixed scope agreed in writing before work starts. You will always understand what we did and why.
03
Confidential by design
We work with firms that live on client trust. Discretion is part of the service, not an add-on.
Get started
Know where you stand in 3 minutes
Free Security Readiness Assessment: tailored stage, gaps, and a recommended path.