Take Charge of Your Cybersecurity

Designed for small financial advisory firms. Know where you stand before a regulator, an insurer, or a client asks.

Get my grade Talk to a real person - (469) 715-5255

Veteran OwnedBuilt by a 30-year practitionerTrusted by RIAs, broker-dealers, and insurance firms

Why advisors come to us

Three Situations That Bring Advisors to H2Cyber

"I got a notice I'm going to be examined."

A regulatory exam (SEC, FINRA, or your state securities division) arrives with a checklist. They want to see documentation of your cybersecurity controls: what you have in place, how you manage it, and what happens if something goes wrong.

H2Cyber walks you through 56 specific controls, produces a scored report with a letter grade, and gives you a document you can put in front of an examiner. You can complete it yourself at your own pace, or have a practitioner walk you through it.

"My broker-dealer told me I need to have this."

Broker-dealers and RIA networks increasingly require affiliated member firms to demonstrate a minimum cybersecurity posture. The requirement is real but the path to meeting it is often unclear.

H2Cyber gives you and your affiliation a shared record of your firm's posture. For affiliation networks, it compresses an audit cycle from months to days.

Cyber insurance application or renewal

Most cyber insurance applications now ask specific questions about your controls. Two come up consistently:

Do you require multi-factor authentication (MFA) on email and remote access?
Do you have endpoint detection and response (EDR) software on every company device?

Missing either one is often an automatic disqualifier. Premiums can increase sharply if other controls are absent.

The H2Cyber assessment covers both of these and the other 54 controls insurers and regulators care about. You will know before you file where your firm stands.

Worth checking

A Note on Microsoft 365 Licensing

Many advisory firms use Microsoft 365 and assume that means their cybersecurity is covered. It is worth checking which plan you are on.

Microsoft 365 Business Basic runs roughly $4 to $6 per user per month. Business Standard runs roughly $12.50 per user per month. Neither includes meaningful security tools.

The plan that includes endpoint protection, advanced threat protection for email, and identity management is Microsoft 365 Business Premium, at roughly $23.10 per user per month.

Most small firms are on the cheaper plans and have not been told the difference. The H2Cyber assessment will surface this gap if it applies to you. This is a money question, not a scare story. If you are paying for a plan that does not cover what you think it does, you want to know.

The basis of your practice

Client Trust

You hold financial data that clients have entrusted to you. That trust is the basis of your practice. A documented cybersecurity posture is part of protecting it.

H2Cyber does not promise that a breach will never happen. It helps you demonstrate that you have taken the steps a reasonable firm takes, and it gives you a record you can point to.

A competitive advantage

Working With Other Fiduciaries

You rarely work alone. The CPAs, attorneys, family offices, trust departments, and financial institutions you work with increasingly ask for evidence that you maintain a real cybersecurity program before they will share data or send referrals your way. A completed H2Cyber assessment gives you that evidence in a form they recognize: a documented, scored report and a seal you can show.

It also sets your firm apart. Most small firms cannot show where they stand on cyber. When you can, it becomes a competitive advantage with clients and business partners, not just a box you check for a regulator. It shows you have taken reasonable measures to protect the business, which lowers both the financial and the reputational risk if something does go wrong.

For affiliations and oversight

For BGAs, Broker-Dealers, and RIA Networks

If your firm oversees affiliated member advisors, you face a different version of the compliance question: how do you verify that your members meet minimum cyber standards?

Traditional audit cycles take months. Gathering self-reported answers firm by firm, following up on gaps, and tracking changes over time is time-consuming work.

H2Cyber gives affiliation networks a centralized view of member firm posture. Each member firm completes their own assessment. You see a portfolio view across all of them. When an exam requires documentation of affiliated firm compliance, the record is already there.

Audit cycles that previously stretched across years compress to days.

How the assessment works

How the Assessment Works

You answer 56 plain-English questions
No technical jargon. The questions cover controls that regulators and insurers specifically ask about: device management, email security, access controls, backup practices, incident response, vendor oversight, and more.
You receive a letter grade (A to F)
The grade reflects your firm's overall posture. A breakdown by area shows where you are strong and where the gaps are.
You get a prioritized action list
The most important items to address appear first. You do not need to sort through everything at once.
Optional: have a real person walk you through it
Prefer a hand to hold? A practitioner walks you through the assessment over two roughly one-hour calls, scoring as you go and answering your questions live, with no upcharge if you need a little longer. If you would rather talk it through before you start, you can book a quick 20-minute intro call first. Either way, you are working with Paul Horn (C|CISO, CISSP, CISM, CRISC, GCIH).

Plans

Pricing

Workspace (Self-Service) is $14.99 per month. Concierge (Full Service) is $24.99 per month. Includes $100 one-time onboarding. See the full breakdown, including affiliation and oversight plans, on our pricing page.

See pricing

From our clients

What Advisors Say

We really enjoy working with H2Cyber. They have been doing a great job for us, and their knowledge of the industry is strong.
John ChuffPresident, BA Securities
Not only were they thorough, but they also took the time to teach us additional cybersecurity best practices.
Andy BrinkmanCEO, Stableford Capital
They had excellent communication with prompt responses. It gave us peace of mind that we are doing things right to best protect the sensitive data of our clients.
Alicia FuschakCOO, Avid Wealth Partners

H2Cyber is listed on the Kitces Advisor Services map (kitces.com, Resources, Advisor Services, Operation Support, Cybersecurity) as a resource for independent advisors.

Who you work with

About Paul Horn

Paul Horn, C|CISO, CISSP, CISM, CRISC, GCIH

Founder and CEO, H2Cyber

Veteran owned. Three decades in cybersecurity. Paul founded H2Cyber in 2019 to give small businesses the same quality of assessment that enterprise security teams use, at a price that makes sense for a small firm.

When you book a call, you talk to Paul. Not a support queue. Not a sales team.

Get Started