Cybersecurity advice & training · For businesses of 10–50
Safer systems.
Smarter teams.
Practical cybersecurity advice and training for small businesses that need senior judgment, a clear plan, and a more resilient team — without building a full security department.
Security you can act on, organized around the NIST Cybersecurity Framework 2.0 — calm, practical risk reduction. No fear, no jargon, no catalog of tools to buy.
Who this is for
Built for owners who carry the risk personally
Safer Together works best with businesses of roughly 10–50 people that hold valuable customer or payment data, rely on an outsourced IT provider, and have no dedicated security leader. If that sounds familiar, the question is rarely whether to improve — it’s where to start, and in what order.
You’re the security department
Decisions about access, vendors, and backups land on the owner’s desk — between everything else. You need judgment you can borrow, in plain language, on a schedule that respects the business.
Your IT provider keeps things running
That’s their job, and it matters. But keeping systems running and deciding how much risk the business should accept are different jobs. Safer Together does the second one — and checks the first.
Most attacks start with a person
Phishing, payment fraud, executive impersonation, and now convincing deepfakes bypass technology entirely. Safer systems need smarter teams — trained, rehearsed, and given simple rules to follow.
The framework
One shared map: NIST CSF 2.0
Every engagement is organized by the six functions of the NIST Cybersecurity Framework 2.0 — the same language your customers, insurers, and vendors increasingly use to evaluate you. Pick a function to see what it means at small-business scale.
Services
Advice, training, and better decisions
Three core engagements and three focused add-ons. Safer Together diagnoses, prioritizes, teaches, and reviews — your team or IT provider implements. Full service details →
How engagements grow
Start small. Prove it. Stay ready.
Most clients begin with the fixed-scope Baseline Sprint — a low-friction first yes with a clear deliverable. From there, the work grows only if the value did.
Start
A fixed-scope Security Baseline Sprint with a clear deliverable: your gaps, ranked by business impact, and a 90-day roadmap.
- Fixed scope, defined timeline
- Owner debrief included
- No obligation to continue
Strengthen
A 90-Day Security Program to work the roadmap — optionally paired with a team workshop or an AI risk review.
- Quarterly security KPIs
- Progress review with the owner
- IT-provider handoff & review
Stay ready
An ongoing Fractional Security Lead relationship: senior judgment on call while your business keeps operational ownership.
- Monthly advisory
- Leadership & board briefings
- Roadmap kept current
Try it yourself · 3 minutes
A quick baseline self-check
Eight plain questions, drawn from the Baseline Sprint. Answer honestly — nobody sees this but you — and get a sense of where your first priorities probably sit.
Clear boundaries
What Safer Together is — and isn’t
What you get
- Independent advice and training, from a senior practitioner
- Priorities ranked by business impact, in plain English
- Plans rehearsed before you need them — tabletop-tested
- A second set of eyes on your IT provider’s security work
- Progress you can see, in quarterly KPIs
What it isn’t
- Not implementation — your team or IT provider installs and operates controls
- Not emergency response — no 24/7 on-call or live incident response for hire; the work is preparation
- Not a tool reseller — no commissions on products recommended
- Not a replacement IT department — direction and review, not help-desk
Insights
Plain-English guidance for owners
Start with the three launch articles — written to be useful whether or not we ever work together.
FAQ
Questions owners ask first
Not sure where your business stands?
That’s exactly what the Baseline Sprint is for. Start with a short fit conversation — no pitch, no pressure.
Services · Advice & training only
Senior security judgment, right-sized.
The strategic thinking of a security leader, focused on the decisions and safeguards that matter most to your business — including the governance decisions the NIST CSF 2.0 Govern function puts in the boardroom.
Every engagement is scoped individually and quoted in a custom proposal. Safer Together advises and trains; your team or IT provider implements and operates. Incident work is preparation only — see the boundary note below.
How it works
From first call to a plan you own
Fit conversation
A short call about your business, your concerns, and your timing. If it isn’t a fit, you’ll hear that plainly — and get a pointer to who might be.
Scoped proposal
A fixed, written scope: what will be reviewed, what you’ll receive, and when. No open-ended billing, no surprise add-ons.
The work
Reviews, interviews, and working sessions with you and — where useful — your IT provider. Findings are explained as they emerge, not saved for a dramatic reveal.
Debrief & roadmap
You leave with ranked priorities, a 90-day roadmap, and the language to explain both to partners, customers, or a board.
The engagement ladder
- Start — Security Baseline Sprint (fixed scope)
- Strengthen — 90-Day Security Program, plus workshops as needed
- Stay ready — Fractional Security Lead, ongoing
The boundary, stated plainly
- Safer Together sells preparation, not rescue: incident plans and rehearsals, never 24/7 emergency response.
- If you are in an active incident right now, call your IT provider, your cyber insurer, or law enforcement first.
- Implementation stays with your team or provider — that keeps advice independent.
Start with the sprint.
Fixed scope, clear deliverable, and a roadmap you keep either way.
About · Karel Baloun, founder
Three decades building technology. One practice making it safer.
Karel has spent his career building, leading, and explaining technology businesses — from inside Facebook in its earliest days to the owner’s chair of his own companies. Safer Together is where that experience becomes practical help for small businesses.
Why a founder runs this practice
Most small businesses don’t fail at security because they don’t care. They fail because security advice arrives as jargon, fear, and a shopping list — with no one accountable for putting it in order. Karel’s background is unusual precisely because it covers both sides of that problem: deep platform engineering on one side, and a master’s in social psychology — how people actually behave, decide, and get fooled — on the other. Add formal cybersecurity training at UC Berkeley, with a capstone on disinformation defense, and you get the practice’s premise: safer systems and smarter teams are one problem, not two.
Safer Together LLC is Delaware-registered and was formed in 2020. It operated as a cybersecurity consultancy from May 2022 through December 2024; this site marks its relaunch, with a tighter, advice-and-training model.
Why rent judgment instead of hiring it? With information-security roles projected to grow 29% (BLS, 2024–2034), senior judgment is expensive to hire; Safer Together rents it by the project.
Off the clock, Karel is part of the ultrarunning community — most recently CTO of UltraSignup, the registration platform for trail and ultra races — and works in English, Japanese, and Czech.
The thread
A career in six chapters
Built at internet scale
Facebook’s first senior software engineer — architected a product, led its team, and worked on the database stability and performance problems of a site growing faster than anyone expected.
Explained the inside story
Wrote Inside Facebook, one of the first books about the company — an early exercise in translating how technology organizations really work for people outside them.
Built and led a company
CEO of i2we, creator of more than 300 Facebook apps and the thruSocial platform. The company was acquired by LEAP Commerce, where Karel continued as CTO — learning security from the owner’s chair, where cost and staff behavior are inseparable from the technical answer.
Cybersecurity, formally grounded
Master of Information and Cybersecurity at the UC Berkeley School of Information. Capstone: disinformation defense — how AI-driven inference can spot coordinated manipulation. Builds on an earlier M.S. in Social Psychology from UC Santa Cruz.
Acted when it mattered
Founded Sunnytize.me in the first weeks of the pandemic, producing 100,000 bottles of hand sanitizer and donating more than 30,000 — logistics, vendors, and trust under pressure.
The practice
Ran Safer Together as a cybersecurity consultancy (2022–2024), then served as CTO of UltraSignup (Dec 2024 – May 2025). Now relaunching Safer Together with a focused model: advice, training, and rehearsal for small businesses.
How the work is done
Three working principles
Calm over fear
Fear sells tools and freezes owners. You’ll get your risks straight — sized, ranked, and in plain words — so you can act on them in order.
People are part of the system
Every control eventually meets a busy human. Training, verification habits, and rehearsed decisions are security controls, not soft extras.
Independent, always
Advice-only means no products to sell and no implementation hours to protect. If the right answer is “your provider has this covered,” that’s the answer you’ll get.
FAQ
About working together
Put that experience to work on your business.
Start with a baseline. Leave with priorities you can explain to anyone.
Insights · For small-business owners
Useful before we ever talk.
Plain-English guides on the questions owners ask most — what a baseline covers, why rehearsed plans beat binders, and how to let your team use AI without leaking the business.
Keep reading
Questions these articles answer
Reading is a start. A baseline is the map.
Find out where your business actually stands — in weeks, not quarters.
Start a conversation
Tell us a little about your business.
Five short fields. You’ll get a reply with a proposed next step — usually a brief fit call — matched to what you share here.