Home/Services/SMB Security Operations
SMB & Mid-Market

Enterprise-grade security operations, sized for the way you actually run.

Most SMBs, municipalities, schools, healthcare practices, and law firms can't justify a full SOC — and shouldn't have to. CyberD20 delivers right-sized managed security: Wazuh-powered visibility, Hermes-assisted triage, and human incident response from people who've actually run investigations.

WHO THIS FITS
  • — Small & mid-market businesses (50–500 staff)
  • — Municipalities & local government
  • — Independent and charter schools
  • — Small & specialty healthcare practices
  • — Law firms with sensitive caseloads
  • — Family offices & investment shops
Where we typically come in

The reality, before CyberD20.

·

Overwhelmed by alerts

Existing tooling generates noise. Nobody has time to triage it, so it gets muted — and then misses the one that mattered.

·

No dedicated SOC

IT carries the load. There's no 24/7 coverage, no detection engineering function, and no playbook beyond "call someone."

·

Limited staff

One or two technical people, stretched across helpdesk, projects, vendor management, and security at the same time.

·

Ransomware concerns

Real exposure, no rehearsed response, and an insurance carrier asking pointed questions at renewal.

·

Compliance pressure

HIPAA, PCI, CJIS, FERPA, state privacy law — controls expected, evidence-of-controls in short supply.

·

Lack of visibility

Logs scattered across tools and SaaS, no single timeline, no honest answer to "what's actually happening on our network?"

What you get

Visibility, triage, and human judgment — bundled.

SECURITY OPERATIONS STACK
  • 01Wazuh deployment. Installed by us if you don't have a SIEM — endpoint, network, and cloud telemetry in one place.
  • 02Hermes integration. AI-assisted triage and enrichment on top.
  • 0324/7 monitoring & IOC alerting. Hermes watches continuously and alerts the owner or designated manager the moment an indicator of compromise is identified.
  • 04Human incident response. Real practitioners, not a script.
EXECUTIVE OVERLAY
  • 05Risk assessments. Baseline + annual review aligned to your sector.
  • 06Monthly reporting. Plain-language reports executives actually read.
  • 07Tabletop exercises. Annual ransomware & insider-threat rehearsal.
  • 08Executive cyber briefings. Quarterly threat & posture briefing for leadership.
Idaho sector focus

Idaho's economy isn't generic. Neither is the threat surface.

CyberD20 was built for Idaho's actual sectors — not for a generic SMB template. Each vertical below brings a distinct combination of regulatory pressure, OT/ICS exposure, and operational reality that we've engineered detections and response workflows around.

·
HIPAA

Healthcare & rural clinics

Magic Valley and Eastern Idaho hospital systems, FQHCs, specialty practices, and dental groups. EHR-aware monitoring, ransomware-recovery readiness, BAA discipline.

·
OT/ICS

Agriculture, dairy & food processing

Dairy operations, potato & sugarbeet processors, feedlots, ag co-ops. PLC and HMI awareness, vendor-VPN scrutiny, IT/OT segmentation reviews.

·
FERPA

K-12 districts & universities

Idaho school districts and Idaho State / BYU-Idaho / CSI scope. Student-data protection, e-rate alignment, BYOD & SIS hardening, board-ready reporting.

·
CJIS · CIS

State & local government

Counties, cities, special districts, and elections offices. CJIS-aware logging, ransomware-resilience posture, cyber-insurance alignment, IT-staff augmentation.

·
GLBA · NCUA

Financial services & credit unions

Community banks and credit unions across Eastern Idaho and the Magic Valley. Wire-fraud monitoring, MFA discipline, third-party risk, examiner-ready evidence.

·
Operational

Construction, manufacturing & logistics

BEC and invoice-fraud prevention, vendor-portal hardening, project-data protection, fleet-IT visibility for distributed sites and yards.

·
Statewide

Tech & professional services

Law firms with sensitive caseloads, accounting practices, ISVs, and professional-services firms. Privilege-aware logging, M365/Google Workspace hardening, SOC-2 alignment.

·
CUI · CMMC

Critical infrastructure / INL-adjacent

Suppliers and contractors operating in the INL ecosystem. CMMC-readiness, CUI handling, enclave architecture, and audit-ready evidence.

·
Sovereign

Tribal nations & gaming

Engagement on tribal sovereignty terms, where appropriate. Gaming-floor and back-office security, NIGC-aware controls, and incident response coordinated with tribal leadership.

If your sector isn't listed — it doesn't mean we can't help; it means we want to scope it honestly first. Idaho is small enough that one conversation tells us whether we're the right fit or whether a referral is the right answer.
Engagement models

Four ways to engage. One firm behind each.

A
Continuous

Managed Security Intelligence

Ongoing managed SOC: Wazuh + Hermes, 24/7 IOC alerting, monthly reporting, quarterly briefings, on-call IR support.

Starting at$750/moscaled by endpoints, integrations & response level
B
Project + retainer

Incident Readiness

Playbooks, tabletop exercises, IR retainer, and pre-event preparation against your real environment.

CustomRetainer-basedproject + standby retainer; emergency rates apply
C
Project

Risk Assessments

Executive-grade risk reviews aligned to your sector — HIPAA, PCI, CJIS, FERPA, state privacy law.

Starting at$2,500+scoped to environment size & regulatory framework
D
Hours

Security Operations Support

Block-of-hours engagements for detection engineering, SIEM tuning, and on-demand investigative help.

CustomBlock-of-hoursquoted by scope; volume discounts on standing blocks
Directional pricing, not off-the-shelf packages. Above figures are starting points to anchor expectations. Every engagement is scoped against your environment, sector, and counsel relationships, with a written quote inside five business days. No surprises.
Onboarding

From first call to operational coverage.

STEP 01

Discovery call

30 minutes. Confidential. We discuss your environment, sector, and pressure points.

STEP 02

Scope & quote

Written scope and transparent pricing within five business days of discovery.

STEP 03

Deploy & tune

Wazuh stood up if you don't already have a SIEM, then Hermes deployed on top with baseline detections tuned to your environment.

STEP 04

Operate

24/7 monitoring with IOC alerts going directly to the owner or designated manager. Monthly reports, quarterly briefings, and an IR line that's always answered.

Engage

A 30-minute discovery call is the right place to start.