How we work
Our method, in the open. Before you sign anything.
How we scope, test, score, retest and hand over, with the engagement models and price bands we use. Judge the method first, then decide.
One named lead
From scoping call to sign-off
Fixed scope, fixed fee
Agreed before work starts
Retest included
Every medium and above
Engagement timeline
What arrives, and when.
Every phase has a week and every artefact has a name. The plan shows the shape; drag the handle below to walk through what lands when.
- Done
- In progress
- Planned
Week
| Phase | Start week | End week | Status |
|---|---|---|---|
| Scoping call + quote | 0 | 1 | Done |
| Kick-off + access | 1 | 1.5 | Done |
| Testing | 1.5 | 4.5 | In progress |
| Critical alerts | 1.5 | 4.5 | In progress |
| Report + readout | 4.5 | 5.5 | Planned |
| Fix window | 5.5 | 7 | Planned |
| Retest + attestation | 7 | 8 | Planned |
Simulated environment, real workflow.
Week 0✓ delivered
Scope document
Targets, rules of engagement, test windows, named lead and a fixed quote.
Week 1✓ delivered
Kickoff
Access checked, contacts agreed, the emergency stop route tested.
Week 2✓ delivered
Live findings feed
Findings land in your tracker as we confirm them; criticals by phone the same day.
Week 4upcoming
Report and readout
Technical report, executive summary and a walkthrough with your engineers.
Week 5upcoming
Retest
Every fix verified; the report updated with status per finding.
Week 6upcoming
Evidence pack
Attestation letter and control mapping for auditors and customers.
Typical fixed-scope test; durations are illustrative
From test to evidence
One finding, followed all the way to the audit file.
The loop most firms split across separate teams. We run it as one: the finding is fixed, retested, watched by the SOC and filed as evidence.
Simulated environment, real workflow.
Engagement models
Four ways to work with us.
Typical shapes, so you can compare before the first call. Final scope and fee are fixed in writing.
Fixed-scope test
A pentest, AI red team, appsec review or MCP permission review
- Typical length
- 1–4 weeks
- Team
- Named lead + 1–2 testers
- You get
- Report, readout, retest, attestation
- Price band
- From $5,000 (web app or API from $6,000)
Campaign
Red or purple team against a business objective
- Typical length
- 4–8 weeks
- Team
- Lead + operators + SOC liaison
- You get
- Attack narrative, gap matrix, detections
- Price band
- From $30,000
Program
Architecture, AI governance or compliance readiness
- Typical length
- 6–12 weeks
- Team
- Lead advisor + specialists
- You get
- Roadmap, policy set, evidence file
- Price band
- From $10,000 (e.g. SOC 2 readiness, audit not included)
Retainer
vCISO, continuous testing or on-call advisory
- Typical length
- Monthly
- Team
- Named lead, fixed days per month
- You get
- Board pack, rolling tests, live findings
- Price band
- From $4,000/month (vCISO)
Severity rubric
How we rate a finding, and how fast you hear about it.
CVSS or OWASP/ATLAS references set the baseline. Your business context sets the final rating, and we write down why.
Direct path to sensitive data, money movement or full control, exploitable now.
Phone call the same day; fix guidance within hours
Serious impact with one extra condition, or a chain that needs a second weakness.
Flagged in the live feed within one working day
Limited impact or harder to exploit; worth fixing in the normal cycle.
In the live feed and the report
Hardening and hygiene that shrink the attack surface.
In the report, grouped by theme
Retest policy
We check our own advice.
A finding closes when we have verified the fix, not when a ticket moves.
- Every finding rated medium or above is retested within 30 days of your fix notice, unless your SOW sets another window
- Each chain is replayed exactly as first exploited, including AI transcripts
- The report is reissued with a status per finding
- A shareable attestation letter once criticals and highs are closed
- Missed detections are handed to your SOC, or ours, as rules
FAQ
Questions we hear most.
Who will we work with?
One named lead from the scoping call to sign-off, plus the specialists your scope needs. You get their names before the engagement starts.
How do you score severity?
CVSS for technical findings, OWASP LLM and MITRE ATLAS references for AI findings, adjusted for your business context using the rubric above. We explain every adjustment.
What does the retest cover?
Every finding rated medium or above. Tell us when the fixes are in and we retest within 30 days of that notice, unless your SOW sets another window. The report is updated with a status per finding.
Do you publish prices?
Yes, as starting prices: fixed-scope tests from $5,000, campaigns from $30,000, programs from $10,000 and vCISO retainers from $4,000 a month. Every engagement then gets a fixed, written quote after the scoping call, before any work starts.
Start with a scope, not a sales call.
A 30-minute call with a senior practitioner. You leave with a written scope, a timeline and a fixed quote.