Assessment Pricing
A network assessment is Jeff Johnson, a Cisco- and Fortinet-certified senior network engineer, measuring your network for a couple of weeks and telling you, in writing, what you have, what is at risk, and what to do about it. It is priced by the size of the network, not by the hour: from $3,500 for a single small site, fixed. Count five things and you know the number before we talk.
What it is
Not a sales pitch, not a penetration test, not a monthly contract. A fixed-price look at your network by someone who only does networks. If you only need the inventory and diagram without the findings and redesign, the network audit and documentation service is $1,250 per site.
One office? Check the Small Business limits below: $3,500, fixed, about two weeks. If your single site is bigger than those limits, the calculator moves you up a tier. Already have an IT provider? Keep them; the report is written so they can act on it.
How we count
Brand mix does not matter: Fortinet, Cisco, Aruba, Arista, HP or Dell are read directly. Unmanaged gear, like the Linksys someone left in a closet, shows in the inventory as what it is.
One physical location with its own internet edge. Two buildings behind one firewall is one site. A branch that reaches the internet only through HQ is a remote branch, an add-on, not a site.
Each firewall, or each high-availability (HA) pair: two firewalls set up so one can fail without stopping the office. A pair counts as one.
One standalone switch, one stack, or one chassis counts as one, however many physical units are in the stack. A shared cloud dashboard alone does not combine separate switches.
Unique devices on your wired and corporate Wi-Fi networks: computers, phones, printers, cameras, servers, and the network gear itself. Guest Wi-Fi is excluded. Never employees.
Wireless APs (the Wi-Fi radios on the ceiling), counted on their own because devices on Wi-Fi do not get a switch port of their own. Corporate Wi-Fi clients are connected devices; guest Wi-Fi is not.
The tiers
Small Business and Mid-Market are fixed prices. Complex and Enterprise start at a floor and are confirmed in writing after a 30-minute call. Every tier delivers the same five things; the bigger tiers deliver more of each. Not included: penetration testing, remediation work, desktop or Microsoft 365 support.
One office, one firewall, a few switches, some Wi-Fi. Inventory, findings, diagram and roadmap; the port-by-port map starts at Mid-Market.
A real network with history: several switches someone else installed, a firewall nobody has audited, maybe a branch over VPN (add-on).
Several locations, or an auditor asking questions. Findings mapped to HIPAA, PCI DSS or SOC 2.
Campus or fleet. Hundreds of devices and a switch stack in every wiring closet.
Small Business and Mid-Market are invoiced in full before the monitoring box ships. The report is yours either way, whether or not we do the work that follows. A credit applies if you sign an Edge plan or Edge Firewall Managed; see the FAQ below. Scoped tiers come with a written quote after a 30-minute call. Prices cover the assessment; what follows is quoted separately after the report: a firewall migration from $6,500 (from $8,900 for larger models), or a managed plan from $695 per site per month. A second Mid-Market site is read remotely; add an on-site day if you want it port-mapped.
Size my network
Nothing is sent anywhere. It runs in your browser.
Everything fits the smallest tier.
Schedule a conversationWe verify the count on the first call. If your network is bigger than you counted, we tell you the tier before any work starts; accept it or walk away at no charge. Not ready to book? See a sample report (PDF).
What you get
The report is yours whether or not we do the work that follows. Bigger tiers go deeper on each one. Read a sample report (PDF) to see the format before you buy.
Every firewall, switch and access point we can reach: model, firmware, and end-of-sale and end-of-support dates where the manufacturer publishes them. You learn what is already unsupported before it bites.
How it is really wired: which switch feeds which, the uplinks between them, and the VLANs (separate lanes so a problem in one cannot reach the others). From Mid-Market up, a port-by-port map of what was seen plugged in where during the monitoring, with the unknowns marked as unknowns. Wireless too: every AP, its clients, channels and power as the controller reports them.
Exposed services, single points of failure, segmentation gaps, configuration drift, PoE and capacity limits, and the places we could not see. Each one says why it matters and what it would take to fix.
What to change and what to buy, sized from measured traffic. If you need a second firewall or a second circuit, the data says so; if you do not, the report says that too.
Quick wins, 30 days, 90 days, one year. Yours to keep and to hand to anyone.
Worked examples
Notice the five-floor building: ten switch groups would fit Mid-Market, but six hundred devices and forty access points make it Complex. The biggest number wins.
| Network | Sites | Firewalls | Switch groups | Devices | APs | Tier | Price |
|---|---|---|---|---|---|---|---|
| Dental office: one firewall, 2 switches, 3 APs | 1 | 1 | 2 | 35 | 3 | Small Business | $3,500 |
| Law firm on one floor: one firewall, 3 switches, 5 APs, 60 devices | 1 | 1 | 3 | ~60 | 5 | Small Business | $3,500 |
| Engineering office with a branch over VPN: one FortiGate, 7 switches from three vendors | 1 + branch | 1 | 7 | ~120 | 8 | Mid-Market | $8,500 + $1,250 branch |
| 5-floor building, 2 wiring closets per floor, a 48-port switch stack in each, HA firewall pair, Wi-Fi on every floor | 1 | 1 pair | 10 | ~600 | ~40 | Complex | from $15,000 |
| 4 clinics, a firewall and 2 switches each, HIPAA mapping | 4 | 4 | 8 | ~180 | 12 | Complex | from $15,000 |
| 12 retail stores, a firewall, a switch and 2 APs each | 12 | 12 | 12 | ~200 | 24 | Enterprise | from $20,000 |
Add-ons
Chosen before work starts, never discovered on the invoice. Travel within Sacramento and the Bay Area is included; beyond that, travel is billed under our expense policy and itemized on the invoice. If you want the same engineer to run the network after the report, see the Sacramento Fortinet MSP page or the Fortinet MSP in San Francisco page.
| Add-on | Price | When you need it |
|---|---|---|
| Remote branch | $1,250 | A small office that reaches the internet through your main office over a site-to-site VPN (an encrypted link between offices). Configs, inventory and monitoring over the tunnel, no visit. |
| Additional on-site day | $2,500 | A second site you want port-mapped exactly like HQ: monitoring box, consoles, one day. |
| Compliance mapping | $2,500 | Map the network findings to one framework for your auditor or insurer: HIPAA, PCI DSS or SOC 2. Any tier; included at Complex and above. It covers the network controls we assessed, not organization-wide compliance or certification. ITAR mapping is quoted after scoping at every tier, because the work depends on which export-controlled systems and data are in scope. |
| Wireless survey | $1,500 per floor | Every assessment reads your access points from the controller. This adds a validation walk and heat map when coverage itself is the complaint, up to 15 access points per floor. |
Questions
$3,500 fixed for one small site: one firewall, up to 3 switch groups, 100 connected devices and 6 access points. $8,500 fixed for Mid-Market (up to 2 sites, 300 devices). Complex is scoped from $15,000 and Enterprise from $20,000. The only extras are the add-ons listed on this page. The fee is prepaid. Sign an Edge plan or Edge Firewall Managed within 60 days of the readout and part of it comes back as a credit: half on a 12-month term, all of it on a 24- or 36-month term, up to one month of the plan fee per year of the term. The report, diagram and roadmap are yours whether or not we do the fixes.
Because it has one login and one configuration. A standalone switch, a stack or a chassis with blades each count as one switch group; a shared cloud dashboard does not combine separate switches. The eight physical units still count as connected devices, which is why a big building lands in a bigger tier anyway.
Employees do not have ports. Printers, cameras, phones, access points, lab instruments and servers do, and every one of them appears in the inventory and the port map. A 40-person engineering firm often has 150 devices; a 150-person call center may have 120. The device count predicts the work; the headcount does not.
No. A network with a SonicWall firewall, two Cisco switches, an Aruba stack and an HP in the closet is counted exactly like an all-Fortinet one: by sites, firewalls, switch groups, devices and access points.
At that price you usually get a questionnaire, a config export and a walk-through. Ours puts a monitoring box on your network for one to two weeks and reads the switches and the firewall directly. You get measured traffic instead of estimates, a bill of materials sized from that data, and from Mid-Market up a port-by-port map of what was actually plugged in.
For Small Business and Mid-Market, yes: the price covers the engineer, the loaned monitoring box, the Mid-Market site visit and the report. The only extras are the add-ons listed above, and you choose those up front. Complex and Enterprise are quoted in writing after a 30-minute scoping call, and the report is yours either way.
Next step
Thirty minutes. We confirm the count and the access we need, then send the agreement. No slide deck. $3,500 for a single small site, fixed; larger networks land in the tiers above. The report is yours to keep. See a sample report (PDF).
