A security bench on Dwight St · Waterbury, CT

the security locksmith for small firms that keep other people’s secrets

Hollister & Vane runs fixed-fee engagements for law and accounting practices — phishing-simulation audits, Microsoft 365 hardening reviews, written incident-response plans. Each job is scoped on one signed page, fitted with care, and billed once by invoice.

book a twenty-minute scoping call read the fee card
fees
$415–$1,375
billing
one invoice, at hand-over
bench
192 Dwight St
Overhead flat-lay: an antique brass key beside a modern hardware security key, a small padlock and a signed scope letter on pale blue paper
Plate I. An old brass key and a hardware security key — the same job, a century apart.

The counter · questions

what managing partners ask before they sign anything

These are the questions that come across the counter most often, answered the way we’d answer them on the phone — plainly, and with the fee already decided.

Before the work

the fit, the fee, the keys

we’re a small office. is this really sized for us?

It is the only size we work at. Every engagement is written for firms where a partner also resets the printer — a handful of seats on Microsoft 365, and client files that carry privilege, tax IDs or wire instructions.

what does the fixed fee actually cover?

Everything named in the scope letter: the fieldwork, the written findings, and one sit-down walk-through. If we under-scoped, that’s ours to absorb. One invoice, issued when the findings are on your desk.

will you need our passwords?

No. For a Microsoft 365 review you grant a time-boxed, read-only Global Reader role and revoke it the day we finish. Be suspicious of anyone who asks for a partner’s password — including us.

Printed phishing emails with blue pencil circles around suspicious sender addresses, a brass loupe and a small key

During and after

the timing, the bad news, your IT

how long until something is in hand?

A phishing audit runs across two to three weeks, so the simulated lures land on ordinary workdays rather than all at once. A Microsoft 365 review or a written incident-response plan is usually on your desk within a fortnight of kickoff.

what if you find something worse than expected?

We stop and phone you the same day — it doesn’t wait for the folio. Fixing it is your call; anything outside the scope letter is quoted separately, in writing, before we lift a finger.

we already have an IT person. why you?

Keep them. Your IT person keeps the machines running; we check the locks they fitted with a second pair of eyes, and write the findings so they can be handed straight over as a work list.

An open navy incident-response binder with blue tab dividers, a printed contact tree and a desk-phone handset

the question that isn’t on this page is usually the one worth asking

A scoping call takes twenty minutes, costs nothing, and ends with a written fee — never a slide deck.

ask it on the phone

What stays on your desk

three documents, each one signed and dated

Locksmiths used to leave a drawing of the mechanism inside the door. We leave paper too — the record of what was examined, what was found, and what was changed, written so it outlives the engagement.

the scope letter

One page, before any work begins: what we’ll examine, what we won’t, the fixed fee and the date it’s due. Your managing partner signs it; so do we. Nothing happens off that page.

  • one page
  • fee in line one
  • due date

the findings folio

Every finding ranked by what it would cost the firm, in sentences a partner can read aloud at a meeting — with the screenshot, the exact setting to change, and who should change it.

  • ranked by risk
  • exact settings
  • plain english

the hand-over hour

A seated hour at your office or at our bench on Dwight St, walking the folio line by line. Bring your IT person and your office manager; nobody leaves holding a question.

  • your office or ours
  • IT invited
  • one hour
A pale blue workbench seen from above with a laptop, a grid of brass key blanks, files, folders and a printed fee card

The fee card · autumn 2026

five engagements, each priced before we begin

Fees are fixed in the scope letter and billed once, by invoice, at hand-over. Settle by ACH, check or card.

  • the first look

    A two-hour walkthrough of how your office signs in, shares files and moves money, with one written page of what to fix first.

    $415reserve →

  • phishing-simulation audit

    Three rounds of realistic lures sent to your staff over two to three weeks, then a short, blame-free session on what got through.

    $640reserve →

  • written incident-response plan

    Who calls whom, in what order, when a client file goes missing — including your insurer’s notice steps and Connecticut breach-notice timing.

    $865reserve →

  • microsoft 365 hardening review

    MFA, conditional access, mailbox forwarding rules, external sharing, admin roles and audit logging — checked setting by setting against your licence.

    $1,180reserve →

  • tabletop rehearsal

    A ninety-minute exercise walking your partners through a staged ransomware morning, using your own written plan as the script.

    $1,375reserve →

a fee written on paper is a fee that doesn’t move

Email us the size of your office and what worries you most. The scope letter comes back signed and dated, with the fixed fee in its first line.

request a scope letter

The bench method

fitted the way good locks always were

Measure before cutting. Test every pin. Leave the owner a key they understand. The tools have moved from brass to browser tabs; the order of work hasn’t.

A disassembled brass lock cylinder with its pins laid out in a row beside tweezers and a network diagram on tracing paper

Waterbury spent the better part of a century as the Brass City — rolling the metal that went into the country’s clocks, buttons and lamp fittings, to tolerances a thumbnail could feel. We took its habits rather than its nostalgia: work to a drawing, check the fit, sign the job.

A small law or accounting practice keeps things worth more than its furniture: privileged correspondence, Social Security numbers, closing-day wire instructions. The locks that guard them now live inside a Microsoft 365 tenant and an inbox. The craft of fitting them properly hasn’t changed at all.

  1. survey the door

    We read before we touch: your licences, sign-in policies, how mail leaves the building, and which accounts still belong to people who left two summers ago.

  2. cut to the firm

    Findings are cut for your practice, not pasted from a framework. A two-partner tax office doesn’t need a forty-page policy; it needs the settings that matter in April.

  3. try every pin

    Each recommendation is tested against a real sign-in or a real inbox before it reaches the folio, so nothing we hand over locks your staff out on a Monday.

  4. hand over the keys

    You keep the documents, the admin access and the reasoning behind every change. If you never ring us again, the work still stands.

“Measure twice in the tenant. Change once in production.”

Chalked above the bench, Dwight St
$415the smallest job on the fee card
$1,375the ceiling — no single engagement crosses it
1invoice per engagement, issued at hand-over

The rule we work by

“A lock you can’t explain to the person holding the key isn’t a lock. It’s a rumour.”

Pinned over the bench at 192 Dwight St
call the bench and have it explained

(475) 269-3473 · Weekdays 11am–5:30pm · or write to talent@hollistervane.com

The bench letter

one plain-english letter a month, written at the same bench

Each issue takes one lock that small firms tend to leave loose and shows how to tighten it, with screenshots. No product pitches. These are the three most recent.

  1. the outlook rule that quietly forwards a partner’s mail

    How inbox rules get planted after a single phished sign-in, and the three-minute check that finds them before a client does.

    August 2026

  2. closing day, wire instructions, and the call-back that saves them

    Why every real-estate closing in your office needs a written call-back rule — and why the number for that call must never come from the email.

    September 2026

  3. the night before tax day is a poor time to test your backups

    A preparer’s restore drill for the quiet months: what to bring back, from where, and how long it genuinely takes on your connection.

    October 2026
send me the next letter

Signing up sits at the foot of this page.

weekdays from eleven, a person at the bench picks up

Weekdays 11am–5:30pm. If it’s urgent — a strange login, a wire that looks wrong — say so first.

ring (475) 269-3473