Consulting
From $225/hour. 2-hour minimum.
Decisions, vendor review, audit prep, or turning a pile of findings into a fix list.
Includes a scope review, a risk assessment, and advisory time. Does not include a penetration test or 24/7 monitoring.
Veteran-owned cybersecurity
Manual tests. Written findings.
Penetration tests and risk audits for South Florida companies that need a person, not a scanner, and a report an insurer, customer, or auditor will actually read.
- Veteran-ownedThe owner does the work.
- 20+ yearsNetworks, DevOps, SecDevOps.
- Fixed scopePrice agreed before testing.
- South FloridaOn site when the work needs it. Remote nationwide.
Three ways to hire the work.
No monitoring contract. No $300 website scan. The scoping call picks the package. You get a fixed quote before anything starts.
Risk audit
From $5,000.
A documented view of risk for leadership, insurance, or compliance prep.
Includes a scoped review, findings in priority order, and practical recommendations. Does not include a full penetration test or 24/7 monitoring.
Penetration test
Typically $7,500–$19,500.
Perimeter, application, or both. Manual testing, a technical report, and a 30-minute readout.
Does not include a full network test, a retest, or 24/7 monitoring. A retest is a separate, smaller engagement.
The report is the product.
A scan lists known issues. A test tries to use them, then says which ones matter and what to do first. The two pages below are the shape. The full sample is seven pages, with the header and the footer a client would see. It is not a client’s report. Read the sample report.
Page 1 · Illustration only
Executive summary
| Engagement | Application test. Staging only. |
|---|---|
| Out of scope | Production, the corporate network, and anything not named. |
| Result | One high finding. No critical finding in this illustration. |
| Do this first | Close the staging admin page. A retest of that fix is a separate quote. |
Page 2 · Illustration only
Finding 1. Staging admin panel answered without a login.
High. A host that was supposed to stay internal returned the admin page with no session.
Evidence in a real report is the request and the response, with secrets removed. Here, that is a GET to the staging admin path and a page that should have required a login.
Fix: put that host behind the same login as production, and confirm it is not reachable from the public internet.
Four steps. Then it stops.
Most scoped tests run days, not months. Dates are set after the scope is agreed.
- 01Scoping call Thirty minutes. What needs testing, and which package fits.
- 02Fixed scope Written scope, rules, and a fixed price before testing begins.
- 03Testing window Manual work, on the dates in the scope. You know when it is happening.
- 04Report and readout The document, then thirty minutes to walk through what to fix first.
Bring this to the scoping call.
Thirty minutes is enough if these four facts are in the email. A missing one does not cancel the call. It does keep the quote from being final.
The target
The application, the site, or the network range you want tested. Name what is included. Name what is not.
Production or staging
Say which environment can be touched. A staging copy is the usual place to start. Production is a different scope.
The deadline
If an insurer, a customer, or an auditor set a date, bring that date and the question they asked. The report answers the question. It does not guarantee they will accept it.
Who can authorize it
The name of the person who can sign the scope. Testing does not start until that person has agreed in writing.
Written authorization.
Nothing on this website starts a test. A test starts when a named person agrees to a written scope: the targets, the dates, what is out of bounds, and how to stop the work. TTCL does not test anything that is not on that page. If you say stop, the test stops that day.
The scope is the authorization. There is no separate surprise. The price is on it before the first request is sent.
Rules of the work.
What you can expect
The person who scopes the work is the person who does it. Testing starts only after a written scope is agreed, stays inside that scope, and stops if you say stop. Findings are ranked so a leadership team can see what is urgent without reading the whole appendix.
On site in Palm Beach, Broward, and Miami-Dade when the scope needs it. Most application testing is remote.
What TTCL will not do
No MDR. No 24/7 monitoring. No bargain vulnerability scan sold as a pentest. No testing outside the agreed targets. No promise that an insurer, a customer, or an auditor will accept the report. That decision is theirs. The report is written so they can make it.
Who this is for.
A fit
Owners of small and mid-size companies who need a real test or a risk audit for leadership, insurance, or compliance prep. You want senior work and a document, not a retainer.
Not a fit
Companies shopping for the cheapest scan, or a full-time security operations team. TTCL stays small on purpose. If you need a SOC, this is the wrong firm.
The systems behind the test.
The report is the product. These are the years under it. Federal and private-sector work. No agency is named here, and no clearance is claimed.
Networks and servers
Four years as integration manager and network administrator at springbig: configuration, monitoring, upgrades, backup, and recovery. Routing, switching, and Microsoft server administration sit under that.
Cloud, DevOps, SecDevOps
Azure and AWS. Docker and Kubernetes. Pipelines, not a slide about pipelines. SecDevOps means the security check is in the build, not a meeting after the release.
Tests and forensics
Penetration tests are the current work. Forensics support is part of the history: what happened, what the evidence shows, and what to fix so it does not happen the same way again.
Still in the room
Instructor at PC Professor in West Palm Beach. DevOps and cybersecurity, plus the Linux and cloud labs. Teaching is not a substitute for the test. It is why the readout is in plain language.
About TTCL
Tanner Tobey Consulting L.L.C. is a veteran-owned firm. Tanner is a U.S. Air Force veteran and a former federal specialist. The service was Active Duty, then civil service. He has more than two decades in networks, integration, DevOps, and SecDevOps, including four years as integration manager and network administrator at springbig. He teaches DevOps and cybersecurity at PC Professor in West Palm Beach. The firm stays small: one person is accountable from the scoping call to the readout.
Tanner Tobey. CISSP. LPIC-1. LPIC-3. CompTIA Security+. CompTIA Network+. CompTIA Secure Infrastructure Expert. Cisco Certified Cybersecurity Associate. Lean Six Sigma Green Belt.
Individual certifications. Not an endorsement of TTCL by Cisco, CompTIA, or the Linux Professional Institute. B.S., Oklahoma State University.
Owner, Tanner Tobey Consulting L.L.C.
Co-founder, VetBattleBuddy.ai
Questions people ask before they book.
Do I book the full pentest from this page?
No. Book the scoping call. You get a fixed quote before testing starts.
How long does a test take?
Most scoped tests run days, not months. The dates are set after the scope is agreed.
Will you work on site?
Yes in South Florida when the scope needs someone in the room. Most application testing is remote, including clients outside Florida.
Is this a vulnerability scan?
No. A scan finds known issues. A pentest tries to use them the way an attacker would, then explains which results matter.
Do you retest the fixes?
Not inside the test price. A retest of the items you fixed is a separate, smaller engagement. Say so on the scoping call if you want it quoted.
Start with the scoping call.
Say what you think needs testing. Bring four facts if you have them: the target, whether it is production or a staging copy, any deadline an insurer or a customer set, and who can authorize the test. You will hear which package fits, and a fixed price, before any work starts.
South Florida. Remote nationwide. LinkedIn.