Most clients start with a fixed-fee assessment, then continue with a monthly retainer. Every engagement covers all of your cyber needs, from policies and vendors to audits, incidents and the board.
In four to six weeks we review your people, processes and technology against the NIST Cybersecurity Framework, interview your leaders and look at how freight actually moves through your systems. You get a clear picture of where you stand and exactly what to fix first.
Depending on size and locations. Half the fee is credited if a retainer starts within 60 days.
Choose the level of involvement that fits your size and the pressure you're under. Every retainer runs 12 months and can move up or down a tier as your needs change.
About 10 hours a month
A senior advisor for leadership's security questions.
About 20 hours a month
A named, senior CISO owns your program and answers for it.
32–40 hours a month
For a board that expects more, or a program to rebuild.
Retainers run 12 months with 60 days' notice and are billed monthly. Hours beyond the monthly allowance are billed at $350 per hour, only with your approval.
SOC 2, PCI DSS, SOX IT controls and customer-audit preparation, from gap analysis to auditor-ready evidence.
A response plan, a ransomware playbook built around dispatch and billing, a tabletop exercise, and response partners lined up.
For private equity firms and acquirers: a fast, independent look at a logistics target's cyber risk, plus a post-close plan.
Board prep, a questionnaire, a second opinion or a one-off question. Two-hour minimum.
Incident coordination and after-hours response leadership, working alongside your IT team, insurer and response firm.
Everything a full-time Chief Information Security Officer would: set strategy, own the security program, manage risk and vendors, prepare for incidents and audits, and report to leadership and the board. You get the same seniority for part of the week, at a fraction of the cost.
A senior security executive leads your engagement from day one and stays with it. You won't be handed off to junior staff, and everything we build is documented, so it stays with your company.
Your IT team and provider run the tools. We set the direction, decide what matters most, hold everyone to it and explain it to leadership. We work alongside them, not in place of them.
No. We don't resell products or accept vendor referral fees, so every recommendation is made only in your interest.
Yes, wherever you operate. Most work is remote, with on-site visits for the assessment, leadership meetings, board sessions and tabletop exercises.
Under a written confidentiality and data-handling policy: your information is used only for your engagement, never shared with other clients, and returned or destroyed when we finish.
Tell us what's going on. In 20 minutes we'll tell you honestly what you need, even if it isn't us.