About
I'm Tom. I've spent more than twenty years keeping organizations secure, and I help people who built a business on their expertise protect what they've built.
I work with coaches, consultants, creators, and course sellers who run a real business online. Your income depends on a handful of accounts: Stripe, YouTube, your email platform, your domain. Some of them are shared with a VA, an editor, or a contractor. They were probably set up one at a time, in a hurry, and nobody has looked at them together.
I do this because people like you did the hard part. You built something real on your expertise, and the tools it runs on rarely explain themselves. Most security advice makes that worse. It's written for companies with an IT team, or it's written to scare you. I don't sell with fear, and I don't think you should have to become a security expert to protect your business.
So I work alongside you. We go through your setup together, in plain language, and make the changes together, so you understand what we did and why. You stay logged in, and you keep control of your accounts. I work with you, not instead of you.
Some people call this kind of work a fractional CISO: a part-time security leader you call on when you need one, rather than hire full time. The title matters less than the job.
Background
Much of my career has been spent as the sole security and systems lead for a group of affiliated operating companies, responsible for everything from the systems people used every day to the security decisions nobody else was going to make. I have handled real incidents, not only planned for them.
I also see this up close at home. My wife is an independent coach and facilitator, so I know what it looks like when a business runs on one person's expertise and a handful of accounts.
That shapes how I advise. It is straightforward to recommend good security when someone else has to find the time and money for it. Having made those calls myself, with a limited budget, a small team, and a business that had to keep running while security improved, keeps my advice grounded in what can actually be done.
Certifications
CISSP, CISM, CDPSE, and PMP. They are worth stating plainly because they show the work has been measured against a standard. Judgment matters more than any of them, and no certification demonstrates that on its own.
What makes this different
Most security advice fails for one of two reasons. It's either too generic to act on, or it's written for a company ten times your size, with a team to carry it out. Useful advice depends on knowing which parts apply to a business like yours and which can wait.
So the work is practical. Recommendations come with an order, a reason, and a realistic sense of effort. I explain them in plain language, so you can answer a client who asks about your security practices, or fill out a cyber insurance form, without a translator. And because I've worked on both the operational side and the technical side, I can talk to you and to the VA or contractor making the changes without either conversation getting lost.
I'm not here to sell you software, and I'm not going to scare you into buying anything. The goal is a business that knows where it stands, has a plan you believe in, and can explain both to anyone who asks.
Join the newsletter
Subscribe and I'll send you the checklist: The Security Questions Every Growing Business Should Be Able to Answer. 26 questions to find the gaps in your accounts, email, backups, and access. Takes about 15 minutes. No security background needed.
It asks things like: Does a VA still have your Stripe login? Is a contractor still in your Kit account? Do you have recovery options on your YouTube channel?
One email a week with practical security guidance for online businesses. No sales pitches. Unsubscribe at any time, and your address goes nowhere else.