Seattle, Washington · Cybersecurity, compliance and GRC for businesses that cannot afford a bad week

Seattle ships. We make sure what you shipped, and who you sold it to, stays yours.

A startup in Pioneer Square answering its first enterprise questionnaire, a dental practice on First Hill, a composites shop in the Kent Valley with Boeing drawings on the server: the Sound is full of businesses whose biggest customer will ask about security before the next contract. We make the answer true, and we watch it around the clock through the Big Dark.

Take the 3-minute Cyber Hygiene Test

Chicago-based, serving the Puget Sound regionEngineer on site for practicesPublic pricingStaff training included

Serving Pioneer Square, South Lake Union, First Hill, Bellevue, Redmond, Kirkland, the Kent Valley and Everett. Remote first, on site when it matters.

A Seattle story

The Tuesday the questionnaire asked the right question

the co-founder of a 19-person software startup in Pioneer Square

It is a Tuesday in early November, dark by 4:30, and the co-founder has a 212-question security questionnaire open on one screen and the company's cloud console open on the other. A Bellevue enterprise wants to sign before quarter end. Their procurement team wants the questionnaire back by Friday. It is the first one the startup has ever received.

The first forty questions are easy. Question 41 asks whether backups are tested. The co-founder checks and finds the nightly database backup has been failing silently since March, which nobody knew because nobody had ever needed it. He writes in progress and keeps going.

Question 58 asks whether access for departed staff is removed within one day. He opens the user list. A contractor who left in June still has an administrator role, and the co-founder reaches for the disable button, then stops to read the login history first.

The account was used at 3:10 that morning from a country nobody on the team has visited.

What changes the ending

Accounts inventoried, a departure that removes access the same day, and a monthly review that catches what the offboarding checklist missed (CIS 5 Account Management)
Backups restored on a schedule, so the answer to question 41 is a date, not a hope (CIS 11 Data Recovery)
Console and login logs that a human engineer reviews, so a 3 a.m. sign-in from a strange country pages someone that night instead of surfacing in a questionnaire months later (CIS 8 Audit Log Management)

What price are you willing to pay to let ten years of building go away because someone overseas tricked one person on your team into clicking a link? The startup, the practice, the shop: it is the same question with a different logo. We would rather you take the week in the San Juans you earned, and step off the ferry to find payroll still there.

Sam Khan, founder. The Cyber Expert in times of peace.

Washington, by the numbers

What the FBI, the state and the researchers counted, not what a vendor guessed.

$458.1M

lost by Washington victims across 25,620 complaints to the FBI in one year

Source: FBI IC3 2025 Annual Report, Washington state page (2026)

8 million

Washington residents affected by the 209 breaches reported to the Attorney General in 2025; more than 80% exposed Social Security numbers

Source: Washington Attorney General, first Data Privacy Report (August 2026)

48%

of breaches now involve a third party, up 60% in one year, which is why your customers send you the questionnaire

Source: Verizon 2026 Data Breach Investigations Report

The law and its clock

Washington data breach notification law (RCW 19.255.010)

Notify affected individuals no more than 30 days after discovery. If more than 500 Washington residents are notified, also notify the Attorney General within the same 30 days with the affected count, the data types, the exposure window, the containment steps and a sample notice.

Regulator: Washington Attorney General · source

My Health My Data Act

In force since March 2024 (June 2024 for small businesses). Covers consumer health data well beyond HIPAA, including wellness apps, fitness data and inferences, and carries a private right of action through the Consumer Protection Act. Washington has no comprehensive consumer privacy statute.

Regulator: Washington Attorney General, plus private lawsuits · source

The regulator has the final say. We help interpret, scope and get you ready; we do not certify.

It happened here

A ransomware attack on the Port of Seattle disrupted Sea-Tac Airport and maritime systems; the Port refused to pay and later notified about 90,000 people.

August 2024 · Port of Seattle

Ransomware took down the Seattle Public Library's catalog, public computers, Wi-Fi and digital lending across all 27 branches for weeks; nearly 27,000 people were notified.

May 2024 · The Seattle Times

Highline Public Schools in Burien cancelled classes for three days for about 17,500 students after detecting unauthorized activity on its network.

September 2024 · The Seattle Times

We list public incidents to show the pattern, never to shame a victim. Any of them could be any of us.

Who we protect in Seattle

Same controls, told from where it hurts for your business.

Medical and dental practices

Between HIPAA and My Health My Data, which one do I get sued under if a patient list leaks from my Bellevue office?

The practice server and each workstation watched around the clock, backups that restore, and a HIPAA risk analysis done on site that also accounts for the state's health-data law.

Education and health services employ 315,500 people in the metro (BLS, July 2026), Washington has 5,597 active dentists (KFF, 2024), and the My Health My Data Act adds a private right of action on top of HIPAA.

How we protect medical and dental practices →

Software and AI startups

Our first enterprise customer sent a 200-question security questionnaire. Do we need SOC 2 to close, or just good answers?

The controls SOC 2 expects, in place and producing evidence, so the questionnaire is answered from a console and the audit, when you choose to do it, is a formality.

Professional and business services is the region's largest private sector at 387,700 jobs (BLS, July 2026), and the 2026 DBIR found 48% of breaches involve a third party, which is why enterprise buyers now ask.

How we protect software and ai startups →

Aerospace and defense suppliers

Boeing wants our NIST 800-171 score. We are a 30-person composites shop in Kent. Where do we even start?

An honest NIST 800-171 score, a system security plan and the controls kept running between assessments, so the next PO is not the one you lose.

Washington ranks 11th nationally in defense spending with $27.2 billion in direct FY2023 expenditures supporting over 100,000 direct personnel (Washington Statewide Defense Economic Impact Study, 2024).

How we protect aerospace and defense suppliers →

Manufacturers

The plant floor runs 24 hours. Who is watching the network at 3 a.m. when the machines are running and the office is empty?

The plant network separated from the office, internet-facing systems patched, and an engineer watching around the clock so Monday does not start with a ransom note.

Manufacturing employs 168,500 people in the metro and grew 2.9% in a year (BLS, July 2026); the 2026 DBIR found 61% of manufacturing breaches involve a third party.

How we protect manufacturers →

Retailers and consumer brands

Our point-of-sale vendor has remote access to all our stores. Is that our risk or theirs?

Card terminals on their own network, vendor access locked down and logged, and monitoring that catches a foreign login before the processor calls you.

The metro holds 353,200 trade, transportation and utilities jobs and the headquarters of several national retailers (BLS, July 2026); the 2026 DBIR found 68% of retail breaches involve a third party.

How we protect retailers and consumer brands →

Medical, dental and other healthcare practices

In Seattle an AccuSights cybersecurity engineer comes to the practice, from First Hill to Bellevue, and sets up the critical controls and the protection agent the same week.

The critical security controls set up in the office, the protection agent on every workstation and the server, the staff trained the same week, and a HIPAA risk analysis that holds up. We work at your speed and we do not bill you per module.

Defense suppliers: Joint Base Lewis-McChord, Naval Base Kitsap, Naval Station Everett and Boeing in Everett and Renton sit above a deep tier of machining, composites and electronics shops in the Kent Valley and Snohomish County. We get a shop to a true NIST 800-171 score and a system security plan, and keep the controls running, because the DoD paused the assessment mandate in July 2026 but the primes did not pause their questionnaires.

Your staff, trained and scored

It is fine to skip the new Nigerian prince's email. Next time, press the report button too.

Your engineers in South Lake Union and your front desk in Kirkland get the same short monthly training, built around the lures hitting Washington inboxes and phones this month, and each person is scored so you know who needs a hand. The report button sits in the mail client and on the phone; one press protects the whole company. We do not charge per module or per test.

Short monthly training tied to the threats we are seeing this month, not a yearly video.
Scored per person and per team, so you know who needs a hand and nobody gets nickel-and-dimed for a module.
Phishing tests that teach the report habit; one report protects the whole company.

Enterprise-grade software, engineers who did this for the largest institutions, and a team that actually picks up the phone. We built this for the institutions that spend the most. We run it for you because we care about what you built.

What we do for a Seattle business

Assess it, keep it compliant, protect it around the clock.

Assess

Cybersecurity and Data Protection Assessment (CDPA)

Where the money, the records and the drawings actually live, what would stop the business, and the ten fixes that matter first. Scored against the CIS Controls and whatever rules apply to you.

Details →

Comply

Compliance, kept current

HIPAA, CMMC, SOC 2, PCI, the FTC Safeguards Rule, state privacy law: one control set, evidence produced once, ready the day a regulator, a prime or a customer asks.

Details →

Protect

24/7 protection for every employee, endpoint, server and website

An AI security agent that contains a threat in seconds and a named human engineer who watches it, day and night. Think of it as a per-employee service, like payroll, except that cutting this corner is the one that can empty the account.

Details →

Or start with the 3-minute test

Governance, Risk and Compliance (GRC), simplified

The discipline the largest institutions run, sized for a business that cannot hire a department for it.

Governance, Risk and Compliance is how a bank or a hospital system decides what to protect, proves it is protected, and shows a regulator the evidence. We ran it for those institutions. We now run it for the 30-person supplier, the medical practice and the defense subcontractor, because that is where the supply chain is thinnest and where a breach does the most damage, sometimes to more than one company.

Governance

Who owns security, which policies are real, and what the owner signs. One page, not a binder.

Risk

What could stop the business, ranked by likelihood and cost, refreshed as the threats change, not once a year.

Compliance

The evidence a regulator, a prime contractor or a customer asks for, produced once and kept current every day.

A defense contractor with 40 people is a link in a national supply chain. A breach there is not a small-business story; it is a national-security one. The same is true, at a smaller scale, for the accounting firm that holds 900 client returns and the clinic that holds 12,000 patient records.

Questions Seattle owners ask

What people in Seattle search for, answered straight.

How much does SOC 2 cost for a Seattle startup, and how long does it take?

Our pricing is public on the site, and a 30-minute demo scopes it to your stack and headcount. The honest answer on time is that the controls, not the audit, set the pace: a startup that already has access reviews, tested backups and monitoring can be audit-ready in weeks. We build the controls first, then the report follows.

What does Washington law require after a data breach?

RCW 19.255.010 gives you 30 days from discovery to notify affected people. If more than 500 Washington residents are notified, the Attorney General gets a notice in the same 30 days with the count, the data types, the timeline and a sample letter. The AG received 209 such reports in 2025, covering more than 8 million residents.

Does the My Health My Data Act apply to my clinic or my wellness app?

If you collect health data that HIPAA does not cover, such as app data, fitness or dietary information, or inferences about health, the Act likely applies, and it carries a private right of action. HIPAA-covered practices still hold non-HIPAA data more often than they think. We map what you hold and what law attaches to it.

We machine parts for Boeing or a Kent Valley prime. Do we need CMMC?

If drawings or specifications marked CUI reach your shop, your contract already requires NIST 800-171 and a score posted in SPRS. The DoD paused the third-party assessment mandate in July 2026, but Boeing and the tier-one suppliers did not pause their questionnaires. A pause is not a pardon; get the score honest now.

Do you come on site for a dental practice in Bellevue or Redmond?

Yes. An engineer comes to the office, from First Hill to the Eastside, sets up the critical controls and the protection agent on each workstation and the server, and trains the staff the same week. The HIPAA risk analysis is done there, so it reflects the practice as it runs.

What does 24/7 protection cost for a 20-person company?

Think of it as a per-employee service, like payroll, priced on the site. It includes the AI agent on each endpoint and server, a named engineer who watches it day and night, and the monthly staff training. Cutting this corner is the one that can empty the account.

Sources: FBI IC3 2025, Washington · Washington AG Data Privacy Report · RCW 19.255.010 · Orrick on the My Health My Data Act · BLS Seattle economy at a glance · KFF active dentists · Washington defense economic impact study · Verizon 2026 DBIR · Port of Seattle cyberattack archive · Seattle Times on the library attack · Seattle Times on Highline schools · FBI Seattle · CISA Region 10

Also serving

San Francisco, CA Denver, CO Los Angeles, CA Minneapolis, MN All cities →

All 20 city pages: Chicago · New York · Los Angeles · Houston · Dallas · Miami · Atlanta · Washington · Boston · San Francisco · Phoenix · Philadelphia · Seattle · Denver · San Diego · Minneapolis · Charlotte · Tampa · Nashville · Austin

Never too big or too small

Let's talk about your cyber anxieties. Thirty minutes, an engineer, no pitch deck.

Book the demo and see how the console watches a business like yours. Or leave your details and an engineer in our Seattle practice replies within one business day.

3-min test