Questions

The questions people actually ask me

Answered the way I would answer them on the phone. If yours is not here, ring and ask it.

What does security monitoring cost for a small business?

Installation on your own hardware is a one-off fixed price of $2,500 — that is my work only, and you provide the machine. If you need the machine as well, the server is $1,800 and the two bought together come to $3,900, which saves you $400 against buying them separately. Ongoing monthly review is $400 a month, sold in three-month blocks, and you can stop whenever you like. Hourly work is $180. New York sales tax applies to the server, because it is equipment; it does not apply to labour or professional services. A managed security service will typically quote a small business $3,000 to $5,000 every month, which is why most small firms go without entirely.

What is Wazuh, in plain English?

Wazuh is a free, open-source security monitoring platform — the same class of tool large organisations run to watch their computers. It collects what happens on every machine you own, notices things that should not be happening, and tells you. There is no licence fee and no per-computer charge. What it needs is somebody who can install it properly and tune it, which is what I do.

Is Wazuh really free? Then what am I paying for?

The software is genuinely free, forever, with no catch. You are paying for installation, configuration, tuning, training and — if you want it — ongoing review. Tuning is the part almost everyone skips: an untuned system fires hundreds of meaningless alerts a day, everyone stops reading them, and within a month it gets switched off.

Do I need a 24-hour security operations centre?

Probably not, and I am not one. Monitoring and reporting here run during business hours. If you genuinely need somebody awake at three in the morning watching a screen, you need a different sort of company and I will tell you which ones to call.

How do the agents get onto my computers? Does someone visit every machine?

It depends what you already have. If you run a Windows domain, the agent is published once through Group Policy and every machine installs it by itself at the next restart. If you already use Intune or PDQ, it goes out through that. If you have neither, it is machine by machine at about ten minutes each, and I quote for that time honestly up front.

Can you monitor switches, routers and firewalls too?

Yes. You cannot install software on a switch, but managed switches, routers and firewalls all speak syslog — they are pointed at the monitoring server and report failed logins, ports going up and down, configuration changes. Printers, cameras and NAS boxes can be brought in the same way.

What is the server you supply, and why is it so much cheaper than new?

An off-lease HP ProLiant. Banks, brokerages and hospitals lease servers on three-year cycles and hand them back on schedule whether or not anything is wrong with them — retired by the calendar, not by failure. A machine of this class sold for around $20,000 new. It comes to you at $1,800 with Linux and Wazuh installed, configured and tested, and it is warranted for 24 months, parts and labour. Add the installation and the pair is $3,900.

Will my staff have to learn Linux?

No. The server runs Linux Mint, which has a Start button, a taskbar and windows you close with an X. Most of your staff will never touch it.

Am I locked in? What happens if I stop paying you?

Nothing stops working. You own the hardware and the software outright. There is no licence tied to me, no subscription to the box, and the monthly review can be cancelled any time. Every client also gets a free copy of the field manual I wrote and published.

My insurer and my customers are asking whether we monitor our systems. Does this answer that?

Yes. Cyber insurance renewals now ask whether you monitor systems and retain logs, and larger clients send security questionnaires before they will sign. This gives you a real, documented answer rather than a hopeful one.

Who are you, and why should I trust you with this?

Michael Rozov. Twenty years in network security and monitoring. I was an HP OpenView Certified Consultant, installed and configured across banks, utilities and multi-site retailers. Before and since: ethical hacking, vulnerability assessment, penetration testing, and network surveillance designed for US Department of Homeland Security grantees. I also wrote and published A Field Manual for Wazuh.

Do you cover my area?

On site across New York State, New Jersey and Connecticut, and remotely anywhere. I am based in the Hudson Valley, so Westchester, Orange and the New York metropolitan area are quickest to reach — further afield in the tri-state area simply means the visit is planned rather than same-week. A great deal of this work is done remotely in any case: the tuning, the monthly review and most troubleshooting never require me to be in the room. Ring and ask — I would rather tell you honestly than take work I cannot serve properly.