Assessment Pricing
A network assessment is a senior engineer measuring your network for a couple of weeks and telling you, in writing, what you have, what is at risk, and what to do about it. It is priced by the size of the network, not by the hour. Count five things and you know the number before we talk.
What it is
Not a sales pitch, not a penetration test, not a monthly contract. A fixed-price look at your network by someone who only does networks.
Most businesses with one office fit the Small Business tier below. The larger tiers exist for multi-site and larger networks; the calculator tells you which one you are.
How we count
Brand mix does not matter: Fortinet, Cisco, Aruba, Ubiquiti, HP or Dell are read directly. Unmanaged gear, like the Linksys someone left in a closet, shows in the inventory as what it is.
One physical location with its own internet edge. Two buildings behind one firewall is one site. A branch that reaches the internet only through HQ is a remote branch, an add-on, not a site.
Each firewall or high-availability pair. An active/passive pair counts as one.
One standalone switch, one stack, or one chassis counts as one, however many physical units are in the stack. A shared cloud dashboard alone does not combine separate switches.
Unique devices on your wired and corporate Wi-Fi networks: computers, phones, printers, cameras, servers, and the network gear itself. Guest Wi-Fi is excluded. Never employees.
Wireless APs, counted on their own because they hide clients from the port map. Corporate Wi-Fi clients are connected devices; guest Wi-Fi is not.
The tiers
Two fixed prices, two scoped floors. Every tier delivers the same five things; the bigger tiers deliver more of each. Not included: penetration testing, remediation work, desktop or Microsoft 365 support.
One office, one firewall, a few switches, some Wi-Fi. Inventory, findings, diagram and roadmap; the port-by-port map starts at Mid-Market.
A real network with history: several switches someone else installed, a firewall nobody has audited, maybe a branch over VPN (add-on).
Several locations, or an auditor asking questions. Findings mapped to HIPAA, PCI DSS, SOC 2 or ITAR.
Campus or fleet. Hundreds of devices and a switch stack in every wiring closet.
Small Business and Mid-Market are invoiced in full before the monitoring box ships. Scoped tiers come with a written quote after a 30-minute call. Prices cover the assessment; implementation is quoted separately, as a fixed fee, after the report. A second Mid-Market site is read remotely; add an on-site day if you want it port-mapped.
Size my network
Nothing is sent anywhere. It runs in your browser.
Everything fits the smallest tier.
Book the callWe verify the count on the first call. If your network is bigger than you counted, we tell you the tier before any work starts; accept it or walk away at no charge.
What you get
The report is yours whether or not we do the work that follows. Bigger tiers go deeper on each one.
Every firewall, switch and access point we can reach: model, firmware, and end-of-sale and end-of-support dates where the manufacturer publishes them. You learn what is already unsupported before it bites.
How it is really wired: VLANs, spanning tree, uplinks. From Mid-Market up, a port-by-port map of what was seen plugged in where during the monitoring, with the unknowns marked as unknowns. Wireless too: every AP, its clients, channels and power as the controller reports them.
Exposed services, single points of failure, segmentation gaps, configuration drift, PoE and capacity limits, and the places we could not see. Each one says why it matters and what it would take to fix.
What to change and what to buy, sized from measured traffic. If you need a second firewall or a second circuit, the data says so; if you do not, the report says that too.
Quick wins, 30 days, 90 days, one year. Yours to keep and to hand to anyone.
Worked examples
Notice the five-floor building: ten switch groups would fit Mid-Market, but six hundred devices and forty access points make it Complex. The largest axis wins.
| Network | Sites | Firewalls | Switch groups | Devices | APs | Tier | Price |
|---|---|---|---|---|---|---|---|
| Dental office: one firewall, 2 switches, 3 APs | 1 | 1 | 2 | 35 | 3 | Small Business | $3,500 |
| Law firm on one floor: one firewall, 3 switches, 5 APs, 60 devices | 1 | 1 | 3 | ~60 | 5 | Small Business | $3,500 |
| Engineering office with a branch over VPN: one FortiGate, 7 switches from three vendors | 1 + branch | 1 | 7 | ~120 | 8 | Mid-Market | $8,500 + $1,250 branch |
| 5-floor building, 2 wiring closets per floor, a 48-port switch stack in each, HA firewall pair, Wi-Fi on every floor | 1 | 1 pair | 10 | ~600 | ~40 | Complex | from $15,000 |
| 4 clinics, a firewall and 2 switches each, HIPAA mapping | 4 | 4 | 8 | ~180 | 12 | Complex | from $15,000 |
| 12 retail stores, a firewall, a switch and 2 APs each | 12 | 12 | 12 | ~200 | 24 | Enterprise | from $20,000 |
Add-ons
Chosen before work starts, never discovered on the invoice. Travel within Sacramento and the Bay Area is included; beyond that, at cost.
| Add-on | Price | When you need it |
|---|---|---|
| Remote branch | $1,250 | A small branch behind your HQ tunnel. Configs, inventory and monitoring over the tunnel, no visit. |
| Additional on-site day | $2,500 | A second site you want port-mapped exactly like HQ: monitoring box, consoles, one day. |
| Compliance mapping | $2,500 | Map the network findings to one framework for your auditor or insurer: HIPAA, PCI DSS, SOC 2 or ITAR. Any tier; included at Complex and above. It covers the network controls we assessed, not organization-wide compliance or certification. |
| Wireless survey | $1,500 per floor | Every assessment reads your access points from the controller. This adds a validation walk and heat map when coverage itself is the complaint. |
Questions
Because it has one login and one configuration. A stack, a chassis with blades, or a cloud-managed group with one policy each count as one switch group. The eight physical units still count as connected devices, which is why a big building lands in a bigger tier anyway.
Employees do not have ports. Printers, cameras, phones, access points, lab instruments and servers do, and every one of them appears in the inventory and the port map. A 40-person engineering firm often has 150 devices; a 150-person call center may have 120. The device count predicts the work; the headcount does not.
No. A network with a Ubiquiti firewall, two Cisco switches, an Aruba stack and an HP in the closet is counted exactly like an all-Fortinet one: by sites, firewalls, switch groups, devices and access points.
At that price you usually get a questionnaire, a config export and a walk-through. Ours puts a monitoring box on your network for one to two weeks and reads the switches and the firewall directly. You get measured traffic instead of estimates, a bill of materials sized from that data, and from Mid-Market up a port-by-port map of what was actually plugged in.
For Small Business and Mid-Market, yes: the price covers the engineer, the loaned monitoring box, the Mid-Market site visit and the report. The only extras are the add-ons listed above, and you choose those up front. Complex and Enterprise are quoted in writing after a 30-minute scoping call, and the report is yours either way.
Next step
Thirty minutes. We confirm the count and the access we need, then send the agreement. No slide deck.
