Threats change every week. Your defenses will too.
Sleep easy.
Casa Fortis gives small businesses what the big firms won't: plain-English security assessments, fixes that matter first, and someone who picks up the phone.
One hour. No obligation. We review your external defenses and show you exactly what an attacker sees.
- Email spoofing protection (DMARC)Missing
- Owner mailbox second sign-in stepNot enforced
- Website certificateValid
- Remote desktop portOpen to internet
- Staff passwords in known breaches7 found
This is what the free hour looks like. Every full assessment ends with a grade, a 90-day plan to raise it, and a free re-test to prove it.
- Title & real estate
- Law firms
- Medical & dental
- Accounting
- Insurance agencies
- Financial advisors
- Construction & contractors
- Property management
- Logistics & import/export
- Hospitality
- Defense contractors
- Nonprofits
- Hablamos español
The attacks hitting small businesses aren't sophisticated. They're just unopposed.
Attackers don't target the biggest businesses — they target the easiest ones. Most of the losses we see were preventable for a fraction of what they cost.
The wiring instructions that weren't
Title agencies, law firms, and anyone moving client money: one spoofed email at closing time can redirect six figures. We check exactly how that happens — and lock it down.
One employee clicked a link
That's the whole story of most breaches. We measure who would click, train the team with real simulations, and make sure one bad click can't become a very bad month.
Your backups vs. a very bad Tuesday
Having backups and being able to restore from them are different things. We test the restore before an attacker forces you to — and make sure the copies they can't touch exist.
You have a plan for fires, floods, and storms. Do you have a ransomware plan?
Same discipline, same peace of mind — for the storm that doesn't show up on radar. We'll tell you what happens if you got hit tonight, and what to do so it doesn't matter.
Find out where you standThree ways to fortify
Fixed prices, defined scope, no surprise invoices. Start with the assessment — everything else follows from what it finds.
Security assessment
From $3,500 · fixed price
A complete audit of your defenses, inside and out, delivered in plain English.
- External attack-surface review
- Cloud & email security check
- Backup restore test
- Graded report + 90-day roadmap
- Free re-test at day 90
Ongoing protection
From $1,000 / month
Your on-call security team, without the payroll.
- Quarterly security reviews
- Phishing simulations & training
- Client security questionnaires handled
- Insurance applications & renewals
- A number to call when something looks wrong
Fixes & IT projects
Fixed-price quotes
Scoped projects that close the gaps the assessment finds.
- MFA rollouts
- Email hardening (SPF / DKIM / DMARC)
- Backup & recovery setup
- Security policies insurers ask for
- CMMC / NIST 800-171 readiness
- General IT projects for clients
What actually lands in your inbox
Not a 90-page PDF of scanner output. Three documents an owner can read over coffee and forward to an insurance broker without translation.
-
01
Executive summary
Two to three pages, plain English. Your letter grade and the top five risks stated in business terms — "an attacker could redirect your customer payments," not CVE numbers.
-
02
Technical findings
Every issue risk-ranked, with the evidence and the specific fix. This is the part your IT person (or we) works from.
-
03
30 / 60 / 90-day roadmap
Each item marked do it yourself, your current IT can handle it, or Casa Fortis can quote it. You decide who does what — nothing is forced on you.
-
04
Debrief call + 90-day re-test
One hour walking through the findings together, then a free re-test at day 90 so the grade is proven, not promised.
Top risks, in plain English
A medical-device maker asked how bad it really was.
A black-box penetration test of an internet-connected patient monitor — no passwords, no inside knowledge, just what an attacker on the same network could reach.
The brief was simple: attack the device the way a real intruder would, then report back in plain English.
A single flaw in the web login let us in with no password at all. From there, each weakness opened the next — until we held administrator access, the patient data the device stored (names, dates of birth, medical record numbers, and readings), and finally full control of the machine itself.
Twelve issues in total, every one confirmed by actually exploiting it — not just flagged by a scanner. Each came with the evidence and the exact fix, ordered so the client knew what to do first. With the immediate and high-priority fixes in place, the device re-tests at A−.
Client and device details withheld.
Full compromise found — then a clear, prioritized path back.
From "not sure" to secured, in four steps
Free mini assessment
One hour, remote. We look at your business the way an attacker would and show you what we find. No obligation.
Full assessment
A deep review of your systems, cloud, backups, and processes. You get a grade, a plain-English report, and a 90-day plan.
Fortify
We fix what matters most first — quoted up front, no open-ended billing. Your own IT can handle items too; the plan says which.
Stay protected
Threats change every week. Ongoing protection keeps your defenses current — and we re-test to prove the grade holds.
Luis Castellar
Founder, Casa Fortis
The strong house
Casa Fortis means "the strong house" — and after ten years in cybersecurity, Luis started it for a simple reason: the businesses getting hit hardest are the ones the big security firms won't touch.
He holds a Master's in Cybersecurity and completed doctoral coursework in cybersecurity management. But what clients actually get is simpler than that: someone who explains security in plain English, fixes what matters first, and picks up the phone when something looks wrong.
Evaluaciones, informes y soporte disponibles completamente en español. La seguridad de su negocio, explicada con claridad.
What owners ask before they book
Will the scans slow down or break anything?
No. The external review only looks at what's already visible from the internet — the same view an attacker has. Deeper testing happens only within a scope you've signed off on, scheduled when it won't get in the way, and nothing is ever run without written authorization.
We already have an IT guy. Why do we need this?
Keeping systems running and keeping them secure are different jobs, and most small-business IT providers are honest that security isn't their specialty. We don't replace your IT — the roadmap marks exactly what they can handle. Many clients bring their IT provider to the debrief call.
How long does an assessment take?
About two weeks from kickoff to debrief, and it needs only a couple of hours of your team's time: a one-hour intake, brief interviews with whoever handles money and accounts, and the debrief. The rest happens on our side.
Is this going to end with a huge bill to fix everything?
Every fix is quoted as a fixed price before any work starts, and the roadmap tells you which items you or your IT can do yourselves. You'll never get an open-ended hourly invoice from us.
Can you help with our cyber insurance application?
Yes. The assessment maps directly to what insurers ask — MFA, backups, email security, written policies — and the executive summary is written so you can forward it to your broker. If you've been declined or quoted a steep premium, this is usually why.
We're a defense subcontractor. Can you help with CMMC?
Yes. If your contracts mention CMMC, NIST 800-171, or DFARS, we'll tell you in plain English which requirements apply to you, measure where you stand today, and close the gaps — policies, access controls, logging, backups, and the documentation (SSP and POA&M) an assessor will ask for. We don't issue the certification itself — only an accredited assessor (C3PAO) can — but we get you ready so the assessment is a formality, not a surprise.
Where do you work?
Anywhere. Almost everything — assessments, fixes, and ongoing protection — is done remotely, so your location doesn't matter. We're based in Miami, and if an on-site visit makes sense, we'll arrange it.
¿Trabajan en español?
Sí. Las reuniones, los informes y el soporte continuo están disponibles completamente en español. Reserve su evaluación gratuita y díganos qué idioma prefiere.
Find out where you stand
A one-hour review of your external defenses — what an attacker sees when they look at your business. Free, and often eye-opening.
Book my mini assessmentPrefer to call or email? (786) 947-8180 · luis@casafortis.com