Security testing for New York companies — billed per engagement

(718) 403-9242

About Evanti · West 137th Street, New York, NY

The Outside Security Team for Companies Told They’re Too Small to Need One

One engagement at a time, one page of paperwork to start, and a phone that’s switched on while we test.

A security consultant’s desk by a tall brownstone window, with a laptop terminal, a handwritten checklist and a coral highlighter in late-afternoon light

I started Evanti for the forty-person practice, the accounting office in tax season, the SaaS team whose first enterprise client just sent a security questionnaire. You deserve the same careful penetration test a bank gets — written down before it starts, explained in plain English when it ends, and priced as a single engagement you can budget for.

Book a free 30-minute scoping call

or ring me at (718) 403-9242, weekdays 9:30–4:30

Who picks up the phone to us

  • Medical & dental practices
  • Law & accounting offices
  • SaaS teams facing SOC 2
  • Nonprofits holding donor data

Big enough to hold data worth stealing, not yet big enough for a security hire of their own.

How Evanti started

I Got Tired of Watching Small Firms Pay for Reports Nobody Could Use

Here’s the short version — the one I tell on scoping calls when someone asks why a security consultancy runs on a one-page contract.

Skip ahead to the house rules ↓
  1. Before

    The Report That Ended Up in a Drawer

    Before Evanti, my working days were spent inside other people’s networks on behalf of much larger clients. The testing was good. What bothered me was what happened afterwards: a smaller firm would pay for the same kind of test, receive a two-hundred-page PDF written for a security department it didn’t have, and file it. Months later the same remote-desktop port was still open to the internet.

    From my notebook“If the office manager can’t read it, it isn’t a finding yet — it’s a rumour.”

  2. The question

    “So What Do We Do on Monday?”

    Every owner asked a version of it. Not “what’s the CVSS score” — but what comes first, who does it, and how long do we have. That’s when it clicked for me: the remediation roadmap is the real product. The test is how you earn the right to write it.

  3. The letter

    One Page, Signed Before Anything Is Touched

    When I set out on my own, the first thing I wrote wasn’t a website. It was the scope letter — targets, testing windows, the fee, and my mobile number for the moment anything looks shaky. It still opens every Evanti engagement, and it still fits on one side of paper.

  4. The block

    Why We Work From West 137th Street

    Harlem is home. It’s also a short ride on the 2 or 3 to most of the offices we test, which matters when an internal assessment means sitting in your conference room with a laptop plugged into the wall jack. The remote work happens here too, on encrypted machines kept for client work and nothing else.

    Practical detailOur nearest stop is 135th Street on the 2/3 — handy if you’d rather talk scope over coffee than over the phone.

A one-page scope letter, a fountain pen and a highlighted remediation roadmap laid out on an oak table

The paperwork, honestly

An Engagement Should Fit on One Table

A scope letter to sign, a roadmap to work through, a pen for the signature. If our paperwork can’t be read over a cup of coffee, I rewrite it until it can.

House rules

Six Rules Taped Above My Desk — and Written Into Every Scope Letter

Less a mission statement, more a list of promises you’re welcome to quote back at me if I ever slip.

  1. Nothing Gets Touched Before the Letter Is Signed

    Not a scan, not a ping. Targets, dates and the fee are agreed on paper first, so your IT provider never wakes up to traffic nobody warned them about.

  2. If Something Might Wobble, I Call First

    Production systems get tested in the window you choose — usually after 7pm. If anything looks unstable, I stop, phone your named contact, and wait for the go-ahead.

  3. Every Finding Leaves With a Fix, an Owner and a Week

    A vulnerability without a next step is just bad news. Ours arrive as tasks your team can drop straight onto a calendar.

  4. Plain English, or It Isn’t Finished

    The executive summary is written for whoever signs the cheque; the findings ledger is for your engineers. Neither gets to hide behind jargon.

  5. Your Data Goes When We Do

    Evidence is encrypted while we hold it and destroyed 90 days after the engagement closes. Passwords never travel by ordinary email.

  6. I’ll Tell You When You Don’t Need Us Yet

    If a $3,900 First Look answers your question, I won’t talk you into a $14,200 Audit-Ready programme. You’ll come back when the bigger test earns its fee.

Where we show up

On-Site Across the Five Boroughs, Remote Wherever You Are

External and web application tests run remotely from our office. Internal network tests usually mean I come to you — or we ship a locked-down test laptop your team plugs in and posts back.

How Evanti tests in each part of New York
AreaHow we usually testGetting there
Harlem & Upper Manhattan On-siteRemote Walking distance, or a couple of stops north
Midtown & Lower Manhattan On-siteRemote Straight down the 2/3, same day
The Bronx On-siteRemote Across the Harlem River, same day
Brooklyn & Queens On-site for internal testsRemote Booked a day ahead so I can arrive early
Staten Island RemoteOn-site by arrangement We’ll plan around the ferry together
Outside the city RemoteTest laptop by courier Shipped pre-configured, returned in a prepaid box

On-site visits are included in the engagement fee anywhere in the five boroughs. Scoping calls happen by phone or video, or in person on West 137th Street if you’re nearby.

Things You Won’t Get From Evanti

  • A software licence bundled with your report

    Instead: recommendations name the fix, never a product we take a commission on.

  • Denial-of-service testing by surprise

    Instead: only if you ask for it in writing, inside a window you choose.

  • Findings sent in an unencrypted email

    Instead: reports arrive through an encrypted share, with the password sent separately.

  • A year-long contract to sign

    Instead: each engagement stands on its own, and you decide whether there’s a next one.

Start with a call

Thirty Minutes, Your Setup, and an Honest Answer About Scope

Tell me how many people you have, what runs where, and what’s nudging you — a client questionnaire, an insurer’s renewal form, a SOC 2 date on the calendar. By the end of the call you’ll know which engagement fits, roughly what it costs, and whether you need us at all yet.

Prefer to write? info@joinevanti.com · or ring (718) 403-9242

What we’ll cover

  1. Your people, systems and the data you’d least like to see leaked.
  2. The deadline behind the call — audit, insurer, client or plain worry.
  3. Which engagement fits, a fee range, and when testing could start.

When I Pick Up

Mon–Fri
9:30am–4:30pm
Evenings
By appointment
Office
124 west 137 th street, New York, NY 10030
Book a scoping call