About the bench · 192 Dwight St, Waterbury
Hollister & Vane is a small security practice on Dwight St that works only for law and accounting offices. We fit the locks on email, files and money the way this city once rolled brass — to a drawing, to a tolerance, and with a signature at the end.
We are not a managed-IT shop, and we don’t resell software. We are the second pair of eyes a small practice calls in to check its locks, and the people who write down, in plain English, exactly how each one was fitted and why.
Then & now
Waterbury rolled the brass that went into the country’s locks and clocks. What a small office has to guard is what a counting-house guarded a century ago — the door, the keys, the record of who holds them. Here is where each one lives now, and what we look at when we get there.
| on the old door | in your tenant | what we check |
|---|---|---|
| the master key | a Global Admin account | Who holds it, whether it doubles as somebody’s everyday mailbox, and whether a second break-glass account exists — with its password sealed in an envelope, in a drawer that locks. |
| the spare under the mat | a shared password on a sticky note | Shared logins for the e-file portal, the bank and the scanner — and how to give each person their own without stopping work in the middle of March. |
| a door left on the latch | a mailbox forwarding rule | Every inbox rule that sends mail outside the firm, who made it and when. It is the first thing an intruder sets and the last thing anyone thinks to look for. |
| the key cut for a clerk who left | an account nobody switched off | Departed associates, summer interns, the consultant from the last migration — still licensed, still able to sign in, still reading the shared drive. |
| the deadbolt | multi-factor sign-in | Not whether it’s switched on, but where it isn’t: legacy mail protocols, app passwords, and the one partner who was granted an exception and never lost it. |
| the locksmith’s record card | the findings folio | What was examined, what was found, what was changed — signed and dated, so the next person to touch the lock knows exactly how it was fitted. |
Each of these six is examined in the Microsoft 365 hardening review ($1,180). The first look ($415) checks the three a small office most often leaves loose.
On a twenty-minute scoping call we’ll tell you which of those six locks to check first. It costs nothing and ends with a fee in writing.
The working day
The hours on the door are the hours the bench keeps. This is how they are spent on an ordinary Tuesday in October — the same order of work whether the job on the bench is a $415 first look or a $1,375 rehearsal.
A person at the bench picks up. Anything urgent — a strange sign-in, a wire that looks wrong — goes to the front of the morning.
Twenty minutes each, free. By the end we know your seat count, your licence and what keeps the managing partner awake. The scope letter follows by email.
Inside client tenants through a time-boxed Global Reader role: sign-in logs, conditional access, sharing settings. Nothing is changed from our side.
Findings are drafted longhand, ranked by what they would cost the firm, then typed up with the exact setting to change and who ought to change it.
At a client’s office or across our own bench, walking the folio line by line with the partners, the office manager and their IT person.
Any access granted for a finished job is removed before we leave, and the removal is noted in that client’s folio with the date and time.
The first look is two hours, $415, and ends with one written page of what to tighten first — before anything larger is ever proposed.
House rules
A trade is defined as much by what it refuses as by what it makes. These are written into every scope letter, and they hold whether the fee on it is the smallest or the largest.
No reseller margins, no licence we profit from. A recommendation names the setting to change, not a product to buy.
The read-only role you grant us is revoked the day the work is finished, and the folio records exactly when.
The fee sits in the first line of the scope letter. If the job runs long, the extra hours are ours to absorb.
Phishing results are reported by office and by lure, not by name, unless the partners ask otherwise in writing. The debrief is about the lure, not the person.
No forty-page policy for a two-partner tax office. If a page of the folio wouldn’t survive being read aloud at a partners’ meeting, it gets rewritten.
Round-the-clock monitoring and day-to-day IT support aren’t ours. If that’s what you need, we’ll say so on the first call and tell you what to ask for elsewhere.
Who sits across the bench
Every one of these practices keeps someone else’s secrets in a filing room that is now mostly a mailbox. Each tends to begin with a different engagement; all of them end with the same folio.
on file · SSNs, powers of attorney
Long client relationships and a great many scanned identity documents, often in shared folders that were opened for one closing and never shut again.
usually begins with the first look · $415on file · wire instructions
One spoofed email on closing day is the whole risk. We start at the mailbox, the staff who answer it, and the call-back rule.
usually begins with the phishing audit · $640on file · W-2s, e-file credentials
The FTC Safeguards Rule expects tax preparers to keep a written information security plan. Most small offices own a template they have never opened.
usually begins with a written plan · $865on file · client bank logins
Many logins, shared too freely, across more client banks than anyone has counted. The review traces who can reach what, and from where.
usually begins with the 365 review · $1,180on file · privileged correspondence
Here the other side sometimes knows exactly whose inbox it wants. Partners in these offices tend to ask for the tabletop rehearsal — ninety minutes on a quiet afternoon, with their own written plan as the script and a staged ransomware morning as the scene.
usually begins with the tabletop rehearsal · $1,375Where the bench travels
From Waterbury and the Naugatuck Valley out to Hartford and New Haven. Fieldwork runs through a read-only role, so where your office sits matters far less than how its tenant is set up.
ring the bench · (475) 269-3473Hand-over hours happen wherever your partners sit. Scoping happens on the phone, weekdays from 11am until half past five.
