Services and prices

Prices for businesses of 1 to 20 people, in US dollars. The free 30-minute call can be booked now; paid work starts in March 2027.

Onboarding assessment

Every engagement starts here: a scored review of your accounts, email, devices, backups and website, with the evidence behind each score and a list of fixes in priority order.

Up to 10 people: $1,500
11 to 20 people: $2,500

More about the onboarding assessment →

Set it up properly

The fixes from the assessment, done by the person who found them.

Website and email 5 to 10 pages, your domain, business email, secure forms: $2,500
Custom software Built around how your business works: Fixed price per job
Other fixes Anything else on your fix list: Quoted in writing

More about website and email setup →

A part-time IT department

A monthly plan for advice and upkeep, with fixed hours, scheduled calls and written updates. Plans run month to month.

Essentials Up to 10 hours, one scheduled call, email support in support hours: $1,500 a month
Standard Up to 16 hours, two calls, written policies, a quarterly review: $2,500 a month
Security lead Up to 20 hours of security work: risk register, policies, incident plan, vendor reviews: $3,500 a month
Extra hours Only by written request: $150 an hour
Extra security hours Only by written request: $175 an hour

More about the part-time IT department →

Prices are reviewed each January. Bigger jobs, or businesses over 20 people, are quoted in writing before any work starts. Unused plan hours don’t roll over.

Selling to the Defense Department?

Small suppliers to the Defense Department have to meet a security standard called CMMC 2.0. A readiness review scores your business against every control in it, with the evidence behind each score and a list of what to fix first. It’s quoted after a short call to agree the scope, and ongoing work runs on the Security lead plan.

How the practice works

Support hours: Weekdays 8 a.m. to 1 p.m. US Eastern. Urgent issues outside them go to the vendor’s support line; emergencies are defined in the agreement.
Replies: Messages sent during support hours get a reply the same business day.
Written first: Updates and questions by email; calls are scheduled.
One engineer: The person you email does the work. No hand-offs, no staff.
Remote only: All work is done remotely. No site visits.
Your accounts, your hardware: You buy hardware and licenses in your own name on the practice’s advice; the practice does not resell.

Why not just hire an IT company?

Many small businesses sign up with a managed IT company (an MSP) on a monthly contract. That’s the better fit if you need someone on call around the clock, a technician who comes to your office, or a helpdesk for a steady stream of everyday requests. If you already have one, the practice can work alongside it, as an independent reviewer of its security work.

Otherwise, here is how this practice differs.

The same engineer every time: At many IT companies a request goes into a ticket queue and on to whoever is free. Here the certified security engineer you email is the one who does the work.
Security first: Security is the core of the practice, not an add-on product. Work starts from a scored assessment with the evidence behind every score, and the report is yours whether or not you hire the practice again.
Nothing to sell you: The practice doesn’t resell hardware, software or licenses, so the advice isn’t tied to a product.
Fixed and written down: A fixed monthly fee for a set number of hours, instead of a bill that grows with every user and device.
No long contract: The monthly plans run month to month. Many IT companies ask for a contract of one to three years.

How to start

Email contact@mercitlabs.com. It goes straight to the engineer who would do the work.
A free 30-minute call. You can book it now.
The onboarding assessment. Paid work starts in March 2027.
A written proposal for anything after that.