Service Tiers

Start with an
assessment, not a sales pitch.

From 24/7 monitoring to full architectural ownership, every engagement is structured, senior-led, and built to eliminate the risks that keep operations leaders up at night. Firewalls. Switching. Wireless. VPN. Monitoring. Compliance. That is the scope — nothing more, nothing less. Serving Sacramento, the San Francisco Bay Area, and Silicon Valley, with remote-managed operations nationally.

The first step

Network Risk Assessment

Before anything changes, you see exactly where you stand. Risk mapped. Drift documented. Path forward defined — whether or not you continue with us. You keep the complete assessment report regardless.

$3,500for one site
Book Your Assessment

Covers one site with one primary firewall, up to three switch groups (a stack counts as one), 100 connected devices and 6 access points: computers, printers, phones, cameras and servers, plus the switches and access points we inspect. Bigger network? See assessment pricing for the four tiers. During the assessment we inspect the firewall, switching, wireless, segmentation, exposed services and device lifecycle, and capture a week of utilization. Most assessments finish within about two weeks, depending on access and scheduling. You receive a written Network Health Report, topology diagram, ranked findings, and a 30/60/90-day remediation roadmap with budget ranges. The report is yours whether or not you hire us for the work. Multi-site, regulated, or complex environments are scoped separately. See a sample report (PDF).

Plan Matcher

Not sure which plan fits? Answer three questions.

We'll point you at the tier that matches your footprint, compliance posture, and the level of ownership you need.

Build your recommendation

Your answers stay in the browser. There is no signup to see a match.

01 · How many sites?
02 · Regulated environment?
03 · Who should own the network?
Recommended Tier
Answer the three questions

Proactive monitoring with quarterly posture reviews — the right fit for most mid-market orgs.

Start with this tier →

We validate fit in the assessment before any retainer decision.

Monitoring → Oversight

Edge Plans — Managed Monitoring

From knowing when something breaks to having someone run it all — choose the level of visibility and response your operations require.

Who it’s for

20–300-person organizations running Fortinet, Cisco or UniFi at one to twenty sites. We cover firewall, switching, wireless and remote access. No help desk, desktops or Microsoft 365. Extra devices beyond a plan’s limit are $25 per device per month; Multi-Site is scoped separately.

What monitoring means

We build and host it. Every minute it checks your firewall, switches, access points and links, then alerts your Slack or Teams channel and us at the same time. A senior engineer responds Monday to Friday, 8 AM to 6 PM Pacific, within your plan’s window. After hours, alerts keep running and an authorized contact can call us in at the emergency rate. You see the same dashboard we do.

How we count

A site is one physical location with one primary firewall. Plans count the network gear we manage: firewalls, switches and access points, plus servers watched for reachability only (we don’t administer servers). The assessment counts every connected device, because it inspects the whole network.

Four tiers. One network-layer scope.

Priced per site / month · network layer only

Most single offices start on Essential or Secure. Regulated practices: Compliance. Three or more locations: Multi-Site.

Edge Essential
$695per site / month
Know when something breaks before anyone notices.

Your network is watched around the clock. You get the alert — not the complaint.

Next-day · Business hours
  • 24/7 monitoring — detectable device, link and performance issues
  • Device health tracking across your infrastructure
  • Alert routing via Slack or Teams
  • Monthly summary — what happened and what's trending
  • No change hours included; standard remote changes (VLANs, DHCP, SSIDs, NAT, VPN users) bill at $225/hr, 30-minute minimum, then 15-minute increments

Up to 10 managed devices. Changes are billed only when you ask for them. Example: two 30-minute changes in a month add $225 to the $695.

Edge Secure
$1,295per site / month
Stop firefighting. Start forecasting.

Proactive monitoring that catches problems while they're still small. The call you never have to make.

Same-business-day response to critical network incidents
  • Proactive trend review — problems caught early
  • Config backup and change tracking — nothing drifts silently
  • ISP escalation coordinated once you authorize us with the provider
  • Quarterly posture check by senior engineer
  • 1 hr/month of standard remote changes included

Up to 20 managed devices.

Recommended for regulated sites
Edge Compliance
$1,795per site / month
Walk into every audit ready.

Monitoring plus security operations. Compliance posture documented, reviewed, current — not aspirational.

Priority same-day response · Business hours
  • Firewall policy reviews — rules justified and documented
  • VPN and access reviews — no orphaned tunnels
  • Vendor vulnerability tracking
  • Log retention recommendations for audit evidence (storage/SIEM scoped separately)
  • 2 hrs/month standard changes included

Up to 30 managed devices. Standard changes: VLANs, DHCP, SSIDs, NAT, VPN users.

Edge Multi-Site
$2,495first site / month, then $995 per additional site
Every location. One standard. Zero variance.

Full lifecycle management across every site. One architecture, one engineer, one standard — everywhere.

Highest priority, named escalation · Business hours
  • Standardized configs across every location
  • Quarterly roadmap review
  • Proactive performance tuning
  • Optional HIPAA / PCI / SOC 2 support, scoped separately
  • 3 hrs/month standard changes, pooled across sites

For three or more sites. Up to 30 managed devices per site; device overages scoped separately. Hours beyond the plan bill at the agreed rate or are scoped as a project.

Billed monthly. You can give notice in the first 90 days and leave 30 days later without an early-termination fee; onboarding fees are non-refundable. The initial term is 12 months; after it, 60 days' notice. Your documentation, configuration history and credentials come back to you within 30 days if you leave.

If we miss the business-hours acknowledgement target on a Critical issue, you can claim a credit of 10% of that site's monthly fee on your next invoice.

Outside business hours

Monitoring 24/7 · emergency work hourly

Human response is business hours. Outside business hours monitoring and alerts keep running; emergency work is $488 per hour, two-hour minimum, when an authorized contact asks. Response means acknowledgement, triage and the start of mitigation, not a guarantee of repair or uptime. Incidents caused by a single-carrier internet outage, end-of-life equipment, changes made without us, or a risk we recommended fixing that was declined are outside response targets and bill at the hourly rate.

Accountability

Ownership Retainers — Ongoing Responsibility

When monitoring is not enough and you need someone accountable for the architecture, the changes, and the outcomes.

This is not outsourced IT. This is a senior network architect embedded in your operations — reviewing every change, catching every risk, and owning the outcomes.

Three tiers of ownership

Add-on retainers, billed in addition to an Edge plan
Network Assurance
$1,500per month, single site
Nothing drifts without you knowing.

Independent configuration oversight and change validation on top of your Edge monitoring plan. When something shifts, you know immediately — not during an audit. It does not replace the monitoring plan.

  • Config diff tracking — every change documented
  • Firewall rule monitoring — no unauthorized changes
  • Change validation — intent matches deployment
  • Anomaly detection for unusual patterns
  • Monthly network health summary
Typical for regulated and multi-site
Architecture Oversight
from $2,750per month · scoped by site count and change volume
Every change reviewed. Every risk caught.

A senior architect reviews proposed network changes and gives written approval guidance before deployment. For changes routed through the agreed change process, qualified review happens before deployment.

  • Pre-deployment change review
  • Monthly architecture call — design decisions with context
  • Vendor change validation
  • HIPAA / PCI / SOC 2 compliance reviews
  • Capacity forecasting ahead of need

Built for healthcare, finance, and multi-site environments.

Embedded Authority
from $6,500per month · 24 engineering hours/month included
A senior network architect, without the hire.

We operate as your network architect. Direct configuration execution, strategic planning, and primary ownership of network-layer operations within the agreed hours, scope and escalation process.

  • Direct configuration execution — changes made, not just recommended
  • Priority escalation — front of queue
  • Multi-year network roadmap ownership
  • Strategic lifecycle and licensing planning

For organizations without a senior network engineer on staff. Hours beyond 24 bill at the specialized engineering rate.

Engagement Process

A defined path from assessment to operations.

No surprises, no shifting scope. Every engagement follows the same four phases — so you always know exactly where we are. The full week-by-week version, with change control, response targets and exit terms, is on how an engagement runs.

01

Network Risk Assessment

Senior engineer reviews your environment end-to-end. Risks mapped. Drift documented. Path forward defined.

About 2 weeks · $3,500 for a single small site
02

Architecture & Design

If you continue, we design the target state — firewalls, segmentation, wireless, VPN, monitoring, evidence. Reviewed with you before anything ships.

Weeks 2–4 · Fixed scope
03

Implementation

Standardized configs deployed via automation. Zero-downtime cutover. Evidence captured as we go — not scrambled for later.

Scoped project · Clear deliverables
04

Ongoing Operations

Monitoring, oversight, or full ownership — whichever fits. The same senior engineer. Optional, but most clients continue.

Monthly retainer

How We Work

Guardrails that don't bend under pressure.

The quiet reasons outages stop, audits go clean, and leadership stops hearing about the network.

Change Review Before Deployment

No change reaches production without a qualified review. The same engineer who designed it approves its deployment.

Evidence Captured as You Go

Compliance documentation produced from real data — not spreadsheets assembled under pressure the week before an audit.

One Senior Engineer, Start to Finish

No ticket queue. No escalation chain. No junior technician learning on your environment. The person who designed it is the person who maintains it.

Specialty Network Services

Already know which engagement type you need?

If you arrived with a specific project in mind — SD-WAN migration, ZTNA implementation, firewall vendor swap, network audit, or one of the other practice areas below — each has its own page with phases, FAQ, and engagement detail beyond the tier framing above.

AI Cluster Monitoring New

GPU health plus InfiniBand and RoCE fabric telemetry for AI training and inference clusters. Monitoring and alerting only; you keep the architecture.

Fortinet MSP — Multi-Site

Standardized FortiGate / FortiSwitch / FortiAP across multi-site fleets. Centralized policy, license procurement, audit-ready evidence.

Managed Network Monitoring

24/7 device, link, and performance monitoring with senior engineer alert routing. Built on LibreNMS / Prometheus / Grafana.

NOC as a Service

24/7 monitoring and alerting with senior-engineer response during business hours. Multi-vendor capable.

Co-Managed Network

Senior network engineering alongside existing internal IT. Three engagement modes (project, retainer, full co-managed).

SD-WAN Migration

MPLS replacement, multi-site SD-WAN deployment, vendor migration. Documented phases, parallel deployment, rollback paths.

Zero Trust Network Access

ZTNA implementation replacing legacy SSL VPN. Identity-bound access, application-specific policies, full VPN decommission.

Firewall Migration

SonicWall, Meraki, WatchGuard, Cisco ASA to Fortinet. Source audit, lab validation, scheduled cutover with rollback.

Network Audit & Documentation

Independent senior-engineer audit. Configuration, segmentation, security posture, compliance gap analysis. Written report.

HIPAA Network Engineering

HIPAA-aligned network engineering for healthcare. Segmentation, access controls, audit trail, BAA-aligned operations.

By Region

Or by where you operate.

Northern California metros where we have direct presence, plus remote-managed operations nationally.

Frequently Asked

The questions we hear most.

We already have an IT provider. Does this replace them?
No. They keep laptops, email and help desk; we take the firewall, switches, Wi-Fi and internet links, and we coordinate with them directly. If you have internal IT that needs senior network help, the Edge plans are built for that partnership. If nobody owns the network today, the Ownership retainers (especially Embedded Authority) cover it fully.
Is the assessment really required?
Yes. Every managed engagement begins with a Network Risk Assessment. Without it, any work would be guesswork — and we do not guess. The assessment gives both of us the clarity to make informed decisions. The report, diagram, and roadmap are yours to keep whether or not you continue with us, and you can hand them to any vendor.
What if we just need a one-time project, not ongoing support?
That starts with the same assessment. From there, we scope Phases 2 and 3 (Architecture & Implementation) as a defined project with clear deliverables, timelines, and a fixed cost. Ongoing operations are optional; many customers add them after the project.
How quickly do you respond when something breaks?
Response windows depend on your tier — from next business day on Edge Essential to priority same business day on Edge Compliance and Multi-Site. Human response is business hours; outside business hours monitoring and alerts keep running, and emergency work is available at hourly emergency rates when an authorized contact asks. Retainers add design review and engineering time; response terms stay as written in your plan agreement.
What happens if our needs change and we need a different plan?
Plans are designed to scale with you. Move to a bigger plan any time with 30 days' notice; the change takes effect at the start of the next billing month. Moving to a smaller plan needs a quick architecture review to make sure the lighter level still covers your risk.
What do you need from us to get started?
Admin access to your firewall, switches and access points, or the name of whoever holds it. Your ISP account details and escalation contacts. Any existing network diagrams, however old. And the names of the people who can approve changes.
Do you sign an agreement with response targets?
Yes. Every plan comes with a written agreement that states business-hours response windows per plan: next business day on Essential, same business day on Secure, and priority same business day on Compliance and Multi-Site. Monitoring runs automatically 24/7; outside business hours, emergency work is available at hourly emergency rates when an authorized contact asks. If we miss the business-hours acknowledgement target on a Critical issue, you can claim a credit of 10% of that site's monthly fee on your next invoice. Response means acknowledgement, triage and the start of mitigation.

Next Step

See your network first.
Pick a plan after.

The assessment gives you a complete picture of where your network stands — risks, drift, compliance gaps. You keep the report regardless of what you decide next.

Book a Network Risk Assessment Send a Message
[email protected] (916) 915-3335 Response < 1 business day

What Happens Next

Response from a senior engineer within 1 business day.

A direct conversation — no sales team, no runaround.

An honest assessment of whether we are the right fit.

Clear next steps if we are — no pressure if we are not.

Schedule a conversation Call