Nightingale Digital Advisors logo Independent security assessments · Front Range, Colorado

Boutique security assessments for small firms across the Front Range.

See what your wireless, your network, your building, and your people expose. Assessed start to finish by me, and reported in plain language you can act on.

Tell me what's going on → Start with The Walkthrough

I don't sell a security product. I tell you what's exposed.

A lot of what gets sold as a security assessment is scoped backward from the paperwork it needs to produce. The work begins from a position already inside your network. The harder question, whether someone could get in at all, is assumed and answered yes. I'd rather test that assumption than write around it.

You get a clear picture and a short list of what to fix first, in terms you can hand to a partner, a board, or an underwriter.

The Walkthrough. Half a day, one office, the whole picture.

In half a day, I walk your office with you and show you the few ways in that matter.

Most small firms have never had anyone look at the whole thing at once: the wireless, the building, the badges, and the habits that decide whether any of it holds. The Walkthrough is one visit that does that. For most practices, it's where I'd start.

We walk and talk. I take a basic look at the wireless networks you run and how they're separated. Then we walk the building the way an intruder would, and I show you what I find as I find it. Standing at the door: this latch can be slipped, and here's how. At the reader: your badge copies in seconds, watch. We set the rules of engagement before I arrive, so each demonstration is already authorized and nothing gets forced, cut, or broken. Along the way we talk through the habits that matter most: how money moves, who calls back to confirm a request, who holds a door for a stranger.

You get a short, plain-language report of what's exposed and what to close first, plus a half-hour debrief call. Where one layer deserves a deeper look, I'll say so. That's a separate, scoped piece of work, and you decide whether to take it.

The Walkthrough is $2,500. The first 8 firms that book it pay $1,000. It's a new offer, those firms help me sharpen it, and they get the full engagement.

It's also what your cyber insurer asks about. The application asks you to attest to specific controls, and at least one insurer has gone to court to rescind a policy over a control that wasn't in place. A documented assessment tells you what you have, and gives your broker something to hold at renewal.

The fuller picture

Three layers of exposure.

The Walkthrough is the front door. Behind it are three layers, each with a small set of deeper, scoped assessments. Most firms need one or two of them, not all.

What someone can reach over the air from outside your walls, from the open internet, and from inside your network.

Wireless assessment

What it is
Every wireless network you run, how they're separated, and what someone in the parking lot can reach. How far past your walls the signal carries. Whether the guest network is separate from the one your files live on. Whether there's an access point in a ceiling tile nobody remembers installing.
Why on site
Radio doesn't travel over a VPN. These questions get answered from inside the building.
What you get
A short report of what's exposed and what to close first.
Pricing
Scoped per engagement.

Network exposure assessment

What it is
What your firm exposes to the internet, what a device on your network can reach, and whether the separation between your networks holds when tested.
What you get
A map of the exposed surface and a ranked list of what to close first.
Pricing
Scoped per engagement. Usually bundled with the wireless assessment.
>I usually scope these two together.

A walk through your space for the things software can't see: who can get where, which badges copy, which doors give, and what's left in the open. This is the layer no remote assessment reaches.

Physical access assessment

What it is
Two demonstrations, done in the open while you watch. Your badges first: I read a credential you issue me for the day, clone it, and present the copy to your own reader. Most proximity cards a small office hands out copy in seconds. Then the doors: the lever handle that can be slipped, the latch that never catches, the motion sensor that can be tripped from the wrong side. I also look for live network ports reachable from a lobby or an empty conference room, and for the server-closet key sitting on top of the frame.
What you get
A written account of what opened and what didn't, and the specific change that closes each one.
What I need from you
A guest badge and a mock employee badge, issued by you on the day.
Not offered
Covert entry. Every visit is announced, scheduled, and escorted. I don't need to break in to show you how someone would.
Pricing
Scoped per engagement.
>Non-destructive: nothing forced, cut, or broken.

Two ways I work on the people side: an assessment that finds out whether one specific attack would succeed, and a program that makes the training you already own worth running.

Objective-based social engineering assessment Single engagement

What it is
One objective, agreed in writing before anything is sent, such as reading a partner's mailbox or getting a payment instruction changed. I research your firm from open sources the way an attacker would and build a few pretexts by hand. Rules of engagement, points of contact, and stop conditions are set up front.
What it tests
Whether your MFA holds against the way credentials are stolen now: a login page that proxies the real one and steals the session, or a consent prompt that hands over a mailbox without a password changing hands. Not whether someone clicks.
What you get
A written attack narrative: what I tried, whether the objective was reached, and exactly how, followed by what to change. If it didn't work, the report says so.
Pricing
Scoped per engagement.

Phishing program refresh Recurring

What it is
I run your existing platform, on your license, alongside your IT provider: audience segmentation, pretexts written for your firm, a sensible cadence, and a quarterly readout.
What it measures
Report rate and time-to-report, the numbers that show whether people speak up. Not click rate.
Who it's for
Firms that already own an awareness platform, often bundled through an MSP or a cyber policy, and never took it past the defaults.
Pricing
Recurring. Scoped per engagement.
>Either one stands on its own.
How the work gets done

AI-assisted. Human-run, every time.

Most of this work is still slow and manual: reading logs, cross-referencing OSINT, staring at a packet capture. I use AI tooling to find and prioritize, never to act on its own.

The tooling narrows and organizes. It doesn't choose what to attack, and nothing reaches you unreviewed.

Vetted for this work by Anthropic and OpenAI →
Vetted access

Vetted for security work by both labs whose models I use.

Anthropic and OpenAI each run their own review for practitioners who use their models in security work. Nightingale was approved by both.

Anthropic

Cyber Verification Program: Defense Access

Nightingale holds Defense Access under Anthropic's Cyber Verification Program, the tier for verified defenders doing incident investigation, malware analysis, and vulnerability analysis and validation. Anthropic verifies each applicant and requires proof of security controls before granting it. The tier covers Claude Opus 5.5, Sonnet 5.5, and Mythos 5.1.

A verification of how I use Claude, at the Defense tier. Not a partnership, certification, or endorsement.

OpenAI

Daybreak Blue

Nightingale is approved for OpenAI Daybreak Blue, a trusted-access tier for vetted defenders with legitimate cybersecurity requirements. It provides OpenAI's most cyber-capable model for this kind of work, subject to OpenAI's usage policies.

An access approval. Not a partnership, certification, or endorsement.

Both are approvals I applied for and had to qualify for. Neither changes how I work.

Ask what that means for your assessment →
Who you're hiring

The technical work, done directly.

I'm Brandon Flanigin. I spent two years in domain and DNS management and two more in email marketing, work that trains you to notice the small misconfiguration that breaks everything downstream. After that came several years brewing professionally, where the job is catching the one variable that's off before it ruins the batch. Security work is mostly that.

I'm building this practice close to home, hands-on, one engagement at a time. That includes a free Walkthrough for one local nonprofit every month. The AI-assisted side of the work is held to the same standard. see how it fits →

  • Technical workScoped, run, and reported directly
  • VettedAnthropic CVP Defense Access · OpenAI Daybreak Blue
  • BasedBoulder–Lafayette, CO
Speaking and workshops

Security awareness for the age of AI.

  • TalkChambers, local business groups, and professional associations
  • CLEBar associations, where the association can accredit it
  • On-siteA working session for your own team, with an optional consented voice-clone demonstration

For years, security awareness meant teaching people to notice what's off: the odd phrasing, the voice that isn't quite right. That training is now obsolete. Voice, video, and writing style no longer prove who is on the other end.

What replaces perception is procedure: an out-of-band callback before anything moves, a money-movement threshold above which one person is never enough, a verification word the office uses. This talk shows a room what's changed, then leaves them with the three or four procedures that hold.

With a volunteer's consent, an on-site session can include a demonstration: their own voice, cloned in the room, making the kind of call your office would take.

Book a talk →
Give-back

One free Walkthrough, every month.

Each month I give one local nonprofit the same half-day Walkthrough, free. Churches, theaters, the places that hold a community together.

See the give-back program →
Start here

Tell me what's going on.

What you're worried about, what prompted this, what kind of firm you are. If I'm not the right fit, I'll point you toward someone who is.

brandon@nightingaledigitaladvisors.com

If something is happening right now, this isn't the right door. Call your cyber insurer's breach line first. I do proactive assessment, not incident response.

Personal and family security, for individuals rather than firms, is inquiry only for now. Say so in your note and I'll tell you where it stands.

Every message gets a personal read. You'll usually hear back within a business day.