toneSec helps entrepreneurs, independent professionals, and very small organizations make sense of cybersecurity. Whether you're unsure what protections you need, questioning an MSP's recommendations, or trying to understand a requirement, you'll get practical answers in plain language—not a sales pitch for products or services you don't need.
Every engagement is led personally by Tony Rothweiler, CISSP, MSCSIA, drawing on enterprise security operations, risk management, and independent advisory experience. Recommendations are matched to your risks, resources, and priorities. Every paid engagement includes a written summary and an actionable, appropriately scoped roadmap.
A guided conversation to help you understand where things stand and what deserves attention first.
Scope: Conversational review, not comprehensive testing or an audit. Choose 60 or 90 minutes of live engagement.
A focused examination of agreed-upon security controls, systems, data-handling practices, or vendor documentation—with a more detailed written roadmap.
Scope: Starts with two hours of active engagement; overall duration and reporting vary by systems, sensitive data, locations, and assessment depth. Not a penetration test, forensic investigation, or formal compliance audit.
A trusted professional to consult when business and security decisions come up.
Scope: Routine advisory questions, not a stand-in security manager. Extended research, meetings, operations, or implementation are separately scoped. Asynchronous effort allowance: up to 30 minutes/month.
More consistent support while your organization builds and refines its security practices.
Scope: Advice and planning—not day-to-day administration, operational security management, or open-ended project delivery.
Part-time security leadership for small organizations that need an accountable strategy and risk program, but not a full-time security executive.
Fit: Primarily 1–25-person organizations; 26–50 considered case by case. Above 50, or highly regulated/complex organizations, generally referred elsewhere. No 24/7 coverage or managed operations.
Targeted consulting that doesn't neatly fit a retainer or checkup, with scope and budget agreed in advance.
Scope: Hourly rates reflect complexity; work is quoted before authorization. No certification, audit opinion, or guaranteed outcome is implied.
Tony holds CISSP, Security+, CySA+, CCSK, and Cloud+ credentials, along with a Master's degree in Cybersecurity and a Master of Business Administration in Information Technology Management — backed by over a decade of hands-on experience spanning military intelligence, enterprise SOC operations, and client-facing advisory work.
Most recently, Tony served as a Senior SOC Engineer at a major enterprise, leading incident response, tuning threat detection systems, and aligning security practices with NIST and MITRE frameworks at scale.
Client-First Approach
Technical depth means nothing if the advice isn't actionable. Every engagement is focused on bridging the gap between security best practices and real business priorities — helping you make confident decisions without drowning in jargon. Whether you're a small business securing your first systems or a growing organization maturing your program, the goal is the same: practical guidance that sticks.
The prices listed above are starting points or defined retainers. Choose a service below to explore sample costs and the situations where different engagement lengths may make sense. These are general estimates, not quotes. Actual pricing is agreed after discussing your needs.
Choose the amount of live discussion time. Both include a concise written summary and prioritized recommendations.
Engagement time is one factor, not a measure of overall coverage. Data sensitivity, number of systems, locations, and the level of written analysis can significantly affect scope.
Illustrative estimates use $100 per active hour, plus $50 for the initial 2-hour assessment, $100 for 3–6 hours, or $150 for 7–8 hours of reporting and documentation. Actual reporting scope and price are determined through discussion; these are not fixed packages.
Fixed monthly retainer for business owners who want someone knowledgeable to ask before making security decisions.
Fixed monthly retainer with more regular collaboration, ideally a one-hour meeting each week.
Ongoing cybersecurity leadership scaled to the organization's needs, beginning at two hours per week. This is a leadership engagement, not outsourced security operations.
Estimates use approximately $115/hour, averaged over 52 weeks, rounded to $25 increments. Standard commitments are 2–10 hours/week. Primarily serving 1–25 employees; 26–50 case by case. Larger or more complex organizations are generally referred to a suitably resourced provider.
Planning estimates only. Final scope, engagement length, reporting depth, and fees are established through discussion. A free 20-minute discovery call can help identify the appropriate service and likely time commitment. Every paid engagement includes a written summary and actionable recommendations scaled to the work. Retainers do not include unlimited requests, routine administration, emergency response, or unused-hour rollover.
Most toneSec services are available remotely. On-site work is available within approximately 100 miles of West Knoxville, Tennessee, measured by one-way driving distance.
Travel time is billed at a deliberately reduced $40/hour—half of my lowest custom consulting rate, regardless of the service delivered. Travel is charged separately from actual on-site consulting, which follows the agreed engagement rate.
Round-trip travel time and mileage are documented. Anticipated travel charges will be disclosed before scheduling; actual tolls and parking are passed through at documented cost. Availability depends on the destination and engagement.
| Travel component | Charge |
|---|---|
| Service area | Up to 100 miles one way |
| Travel time (round trip) | $40/hour |
| Mileage (round trip) | $0.75/mile |
| Tolls & parking | Documented actual cost |
Whether you're looking for a one-time consultation, ongoing support, or just not sure where to start — I'm here to help. Reach out and tell me what you're facing. You'll get a direct, honest response with clarity, not jargon.
Start the Conversation →toneSec — Tony Rothweiler, CISSP
Reach out to start a project, request a consultation, or ask a question. You'll get a direct, honest response — no sales pitch, no jargon.
