BH

What you're building:
IRPForge, generates branded, audit-ready incident response plans for small orgs and nonprofits, built on NIST and CIS frameworks. You answer questions, it builds the plan.

Who it's for:
Small orgs and nonprofits who have real cyber risk but get priced out of the $5K-$15K+ consultants charge for this.

Hardest part right now:
Making sure the intake actually captures enough nuance that the output isn't generic boilerplate, since half the value of a real IR plan is that it reflects your actual environment, not a template.

Live at irpforge.com. Would love feedback from anyone building in compliance or security tooling.

These days I build incident response plans that would've cost $5,000 to $15,000 or more from an outside firm. I know because we looked, and there was nothing out there worth the price.

Going on 30+ years in this industry. Started as an intern at IBM, cut my teeth on mainframes, worked through the early distributed computing era with NT 4.0, lived through Y2K, spent time on Wall Street. Now I'm a Director responsible for cybersecurity and incident response.

That pricing gap is what got me building. Two years of development, running in real production, still getting refined every time a new problem shows up. I tried the AI slop route first and it wasn't good enough. This needed real logic and decision trees a generic output can't fake.

If you're building anything in security, compliance, or for small orgs and nonprofits, happy to compare notes on what's actually working versus what just sounds good in a demo.