Obsidian RidgeFinancial advisor cybersecurity
Managed cybersecurity for SEC-registered investment advisers running Microsoft 365 or Google Workspace, a custodian portal, a CRM and planning software. We operate the monitoring, the identity detection and the training, then hand your CCO the written incident response program and the records that show it is working.
Obsidian Ridge is a CISSP-led managed security provider serving SEC-registered investment advisers in the Research Triangle and across the United States; managed detection and response starts at $25 per person per month on Ridge Core, month-to-month with no minimum and no contract, with 24/7 monitoring of every computer and work-account login and human-led containment, and it maps to the safeguards and incident response program SEC Regulation S-P requires.
TL;DR
The SEC amended Regulation S-P in May 2024. Advisers with at least 1.5 billion dollars in assets under management of at least 1.5 billion dollars had to comply by December 3, 2025, and smaller advisers by June 3, 2026. Both dates have passed, and the SEC's Division of Examinations lists Regulation S-P in its fiscal 2026 examination priorities.
The rule asks for three things a small firm usually does not have: a written incident response program that can detect, respond to and recover from unauthorised access to customer information; notice to affected customers within 30 days; and oversight of the service providers that hold customer information.
We operate managed detection and response, identity threat detection and security awareness training for the firm end-to-end, and produce the written program and the records behind it. The 24/7 SOC watches every computer and your Microsoft 365 or Google Workspace tenant for the three patterns that actually hit advisory firms:
Pricing, per month:
Log collection is Ridge Log, an add-on on any tier.
Broader than Regulation S-P? The financial services and insurance agency page covers state-registered advisers, wealth managers and independent agencies, including the month-to-month option for a solo firm.
What the rules ask, and who does it
No vendor can make a firm Reg S-P compliant, and we don't claim to. These are the rule's requirements, the plan each one sits in, and the part that stays with your CCO.
| What the rule asks for | What we do, and in which plan | What stays with you |
|---|---|---|
| Detect, respond to and recover from unauthorised access to or use of customer information. | Ridge Core: 24/7 monitoring of computers and work accounts, with Huntress's SOC reviewing every alert and containing a compromised machine. Ridge Plus adds email protection and the work browser. | Approving the recovery steps, and the recovery arrangements we do not sell — backup and restore. |
| A written incident response program, maintained as policies and procedures. | Ridge Reserve: a written incident response plan, drafted in the first 30 days, reviewed with your CCO and walked through once a year. | Adopting it into the compliance manual, and keeping it current. |
| Notice to affected customers as soon as practicable and no later than 30 days after becoming aware of a qualifying incident. | Ridge Reserve: the notice procedure inside the response plan, plus the documented record of the incident — so your CCO can decide and send. | Deciding whether notice is required, including any reasonable-investigation exception, drafting it and sending it. |
| Oversight of service providers that hold customer information, including a commitment to notify the firm no later than 72 hours after becoming aware of a breach. | Every plan: a written engagement agreement signed before any access, plus our security documentation and due-diligence material for your service-provider file. The 72 hours is what the rule asks your firm to arrange with its providers; it is not a notification-time promise from us. | Keeping the provider list current, arranging the notification commitment with each provider, and documenting the oversight. |
| Written records documenting compliance with the rule. | Ridge Reserve: quarterly admin-access reviews and a monthly patch report, beside the monitoring records, the MFA coverage report and the training completions. | Retention, and deciding what goes to an examiner. |
Sources: SEC Regulation S-P amendments (Release 34-100155), the SEC's small-entity compliance guide and the Division of Examinations' fiscal 2026 priorities, all read on October 22, 2026. A general summary, not legal advice.
Island Enterprise Browser
Keep control of work data, on company and personal computers.
Your practice software keeps running exactly as it does today. Island Enterprise Browser only changes the browser, so the planning and portfolio software on the desktop is untouched, and the web apps your team already uses — the ones this adds policy to — open the way they always have.
Included in Ridge Plus. No separate price.
Also included in Ridge Reserve.
An everyday decision
A staff member downloads a client statement to a home laptop.
Set the rule for each app: allow, watermark or block the action.
Illustrative controls. Rules are configured for your work apps.
What's included
Adviser laptops, the office workstations, any server the firm still runs, and the Microsoft 365 or Google Workspace box. Huntress's 24/7 SOC reviews every alert and acts on it — remediates it, notes it, or takes the computer off the network.
A sign-in from a computer nobody recognises, and the inbox rules used to hide a reply about a distribution request. On Microsoft 365 it also catches the adversary-in-the-middle kits that get past MFA and the OAuth-consent attacks against firm tenants.
Phishing simulations built on what actually arrives at an advisory firm: a client asking for a wire, a custodian lookalike asking you to re-authenticate, a fake e-signature request.
The incident response plan Regulation S-P requires, drafted in the first 30 days and reviewed with your CCO, plus the monitoring records, MFA coverage report and training completions that show the program is operating.
We review MFA, admin separation, user access, former staff, external sharing and audit logging on the Microsoft 365 or Google Workspace tenant and the web apps that front it, and deliver a list of fixes the firm or its IT vendor applies.
If something happens we coordinate the forensics, produce the timeline and the technical record, and support the cyber-insurance claim. Your CCO stays the decision-maker on customer notice; we operate every technical and process step.
How we work
Keep your IT company. They handle the help desk, the hardware and the everyday fixes. We run the security layer beside them: threat detection and response, and the evidence insurers and auditors ask for.
The threat model
Three patterns, and all three end at the same place: money or client information leaving the firm on an instruction that looked real.
An email arrives from a client's address, or something close to it, asking for a distribution or a wire to a new account. It references a real conversation, because the attacker has been reading the mailbox. The request is urgent and the client is travelling, so a call back is inconvenient.
The control that stops this costs nothing: a call back to a number already on file, never a number in the email, before any distribution or any change of bank details. We help you write it down and train the staff who have to hold the line. The full walkthrough.
The adviser signs in on a page that only looks like the custodian or the tenant. Then:
Identity threat detection is the control that sees this, because none of it looks like malware on a laptop. How identity monitoring works.
A statement downloaded to read at home. A laptop a family member also uses. A machine that leaves the firm with a departing adviser. Nothing was hacked; the files were simply somewhere the firm could not account for.
Two things help: knowing which computers hold what, which the Readiness Sprint documents, and keeping client files inside the work apps in the first place, which is what the work browser is for.
The insurance wedge
A 2026 cyber questionnaire asks an advisory firm for the same short list every time:
In 7 business days the Cyber Insurance Readiness Sprint maps every question on your carrier's questionnaire to the control that answers it, closes the gaps we can, and hands you a signed evidence pack. The same pack is what your service-provider file and your own risk assessment can rest on.
Flat fee, $1,500–$3,500 depending on office count and scope. Delivered, or we keep working at no additional cost until it is. We don't control underwriter decisions. We control whether you walk in with the evidence they ask for.
Obsidian Ridge is not an insurance producer, broker, or agent. We do not sell, place, or advise on insurance products.
Honest fit check
How we start
Tell us how the firm runs. Registration, headcount, custodian, CRM and planning software, who your IT company is, who your CCO is, the renewal date, and what is driving the conversation. We tell you which plan fits and where the real gaps are.
Computer and person counts, plan recommendation, the rollout schedule, and the written deliverables. Fixed monthly pricing. Setup is a separate, disclosed fee.
Managed EDR on every computer. Identity threat detection connected to your Microsoft 365 or Google Workspace tenant. The awareness program launched with a phishing simulation built on what arrives at an advisory firm. The written engagement agreement signed before any access.
The SOC is watching from day one. Obsidian Ridge handles escalations, the incident response plan drafted in the first 30 days and reviewed with your CCO, the records an examiner would ask for, and the cyber-insurance renewal package.
Regulation S-P in plain English
The SEC adopted the amendments on May 16, 2024. They cover SEC-registered investment advisers, broker-dealers, investment companies, funding portals and transfer agents. Exempt reporting advisers are outside the investment-adviser scope.
For SEC-registered advisers the compliance date was December 3, 2025 for firms with at least 1.5 billion dollars in assets under management, and June 3, 2026 for smaller firms. Both have passed, so a small covered adviser needs the program in place now, not planned.
The SEC's Division of Examinations lists Regulation S-P in its fiscal 2026 priorities and says examinations “will focus on firms' policies and procedures, internal controls, oversight of third-party vendors, and governance practices.” After the compliance dates it says it will examine “whether firms have developed, implemented, and maintained policies and procedures in accordance with the rule's new provisions that address administrative, technical, and physical safeguards for the protection of customer information.”
A state-registered adviser generally falls under the FTC Safeguards Rule and its state regulator's rules rather than Regulation S-P. If the firm is heading for SEC registration, build the Regulation S-P program before the switch, not after it. The financial services page covers that case.
This is a general summary for educational purposes, not legal advice. Application depends on your firm's registration, activities and facts, and the rules change over time. Consult qualified counsel and the official SEC guidance. Sources: the SEC's Regulation S-P rule page, the fiscal 2026 examination priorities, and, for a plain-English walkthrough, Holland & Knight on the approaching compliance deadline. All read on October 22, 2026.
Adviser field notes
Hands-on long reads, written for a principal or a CCO rather than a security specialist.
The pillar piece. Which rules a solo or two-person firm actually answers to, and the order to build the program in.
Read the articleWhere the Gramm-Leach-Bliley Act, the FTC Safeguards Rule and Regulation S-P overlap, and which one your firm is answering to.
Read the articleWhat identity monitoring catches on each platform, and the containment differences that matter when an adviser's account is taken over.
Read the articleReal arithmetic, including onboarding and the difference between per-device and per-person pricing.
Read the articleQuestions principals ask
No, and no vendor can. Regulation S-P puts the obligation on the firm.
What we deliver are the controls the written program rests on — monitoring, identity detection, training, the security settings review — and the records that show they were operating.
Your CCO owns the program, decides whether a customer notice is required, and sends it.
No. Your desktop software keeps running exactly as it does today.
The browser only changes the browser, so the custodian portals, the CRM, the planning tools and the e-signature service open the way they always have — with policies on what can be downloaded, copied or printed out of them.
You can also start with the browser alone, month to month, before moving to a full plan.
No. We are a managed cybersecurity firm, not an MSP and not a compliance consultancy. Your IT company keeps the help desk, the hardware and the everyday fixes.
Your compliance consultant keeps the manual, the mock exam and the regulatory judgement. We run the security layer beside them: detection and response, and the evidence an examiner or an underwriter asks for.
Endpoint agent rollout typically completes within 5 business days of contract signing. Identity threat detection on Microsoft 365 or Google Workspace activates within 24–48 hours of tenant connection.
The awareness training program launches within the first two weeks. The incident response plan is drafted in the first 30 days and reviewed with your CCO before it is finalised.
Huntress's 24/7 SOC acts on the alert around the clock. For an active incident, call your cyber insurance carrier's breach hotline first; there is no emergency line here.
Within one business day, Obsidian Ridge takes over everything past containment. We coordinate the forensics, produce the timeline and the technical record your Regulation S-P notice decision rests on, and support the cyber-insurance claim.
Your CCO remains the decision-maker on whether customer notice is required and on sending it; we operate every technical and process step.
Two ways to start
The 10-minute assessment scores the firm against the controls the SEC and your carrier ask about — no email required to see your result.
The 30-minute briefing goes deeper — registration, custodian, headcount, renewal date, the threat model, and what your first 90 days would look like.
Both are free, both are no-obligation, and we tell you when you don't need us.
Read the industry guide, compare the service scope and start with your carrier's actual questions.