Tier 2 — Executive Fortress
Digital Shield protects your online data. Executive Fortress goes further — protecting the physical home network where your work laptop, security cameras, smart TV, and personal devices share the same unprotected subnet. We deploy enterprise-grade hardware at your property and manage it for you. Real protection, not just software.
The Problem
The average home network is a single flat subnet. Every device — your work MacBook, your Ring cameras, your kid's tablet, your smart fridge, your NAS with client files — can communicate with every other device. Freely. Without restriction.
A flat network means a compromised Ring camera has a direct path to your work laptop. A malicious guest device can scan and reach your NAS. A hacked smart TV can pivot to your financial data. This isn't theoretical. It happens.
Hardware Deployment
Every Executive Fortress engagement includes the following hardware, pre-configured by SPG and deployed at your location. You own every piece outright. Nothing is leased. Nothing is shared.
The UDM-SE is the command center of your hardened network. It handles enterprise-grade routing, firewall rules, intrusion prevention, and VLAN segmentation — the same technology used in corporate data centers, deployed in your home rack or utility closet. SPG pre-configures all VLAN policies, firewall rules, and traffic shaping before installation day.
The Firewalla Gold Pro adds a layer of active security intelligence that sits alongside the UDM-SE. It performs deep packet inspection on all network traffic, identifies behavioral anomalies (a device suddenly scanning your network at 3am), blocks malicious domains in real-time, encrypts all DNS traffic, and runs a built-in WireGuard VPN server so you can connect securely from anywhere in the world. SPG monitors your Firewalla dashboard continuously via the Firewalla MSP portal.
Software-based two-factor authentication (SMS codes, authenticator apps) can be bypassed through SIM-swap attacks and sophisticated phishing. YubiKeys use hardware cryptography — the private key never leaves the device, making phishing mathematically impossible. SPG enrolls your YubiKeys across all critical accounts: email, password manager, financial accounts, and work SSO. Two keys are included: one for daily use, one stored securely as backup.
Whole-home WiFi 6 coverage, VLAN-aware, managed entirely by SPG. Each access point broadcasts your four VLAN-segmented networks simultaneously — so your personal devices connect to the PRIMARY network, guest devices connect to GUEST, and IoT devices land on IoT — all automatically, all isolated from each other. SPG handles firmware updates, channel optimization, and monitoring through Ubiquiti Site Manager.
Network Architecture
The Executive Fortress deployment creates four completely isolated network segments from a single internet connection. Devices on one segment cannot initiate communication with devices on another — by design, at the hardware level.
Your personal laptop, work machine, iPhone, and iPad. Highest trust level. Full internet access. Can communicate internally only with other PRIMARY devices. No visibility to IoT, Guest, or Work segments.
Every smart device in your home. Internet access only. Zero visibility to PRIMARY or WORK. A compromised Roomba, Ring camera, or Amazon Echo cannot reach anything that matters. Firewalla monitors all outbound traffic from this segment for behavioral anomalies.
When guests connect to your WiFi, they land here. Internet access only — no visibility to any of your personal devices, drives, or data. New device quarantine rules can trigger automatic alerts to SPG when an unknown device appears on this segment.
Employer-managed devices, VPN connections, and business-sensitive traffic. Policy-based routing sends all work traffic through your WireGuard VPN automatically. Isolated from personal devices — your employer's IT cannot see your personal network, and your personal devices cannot see your work data.
Deployment
Executive Fortress deployments follow a structured four-phase process. We handle all configuration before arriving at your location — installation day is clean and efficient.
We complete your intake, review your property layout and ISP configuration, and design your VLAN architecture. Hardware is ordered for your deployment.
All hardware is pre-configured at SPG before installation day. Your VLAN policies, firewall rules, DNS settings, VPN, and YubiKey enrollments are tested and ready before we arrive.
On-site installation at your property. We replace your existing router, install and position APs, verify all four VLANs, enroll your devices, complete YubiKey account setup, and walk you through operations. Typically 4–6 hours.
SPG monitors your network 24/7 through the Firewalla MSP portal and Ubiquiti Site Manager. Alerts are triaged by SPG — you hear from us when something requires your attention, not for every routine event.
Pricing
Hardware is client-owned outright. Monthly retainer covers SPG monitoring, threat response, reporting, and management. No surprises.
Everything in Standard, plus expanded coverage for larger properties, additional access points, and extended on-site time for complex installs.
Each additional property is scoped and quoted separately. Multi-property clients may qualify for Tier 3 — Estate Legacy pricing. Contact for a free consultation.
Hardware is purchased by SPG on behalf of the client and included in the setup fee. Client takes full ownership on installation day. SPG retains zero ownership of deployed hardware. All engagements include NDA and LPOA (data removal scope). Service agreement required prior to deployment.
Questions
Ready to harden your perimeter?
The assessment is free, confidential, and without obligation. We'll review your current network setup, identify exposure points, and tell you exactly what we'd do about it.