No criticals,no fee.
We scope the work and agree a fixed fee before anything runs. You pay it only when we confirm at least one critical finding. No confirmed criticals, and the engagement costs nothing.
Always included
- A fixed fee agreed up front, payable only if we confirm a critical
- Written rules of engagement and a network-enforced allowlist
- The model running inside your own environment, isolated and destroyed after
- Human review of every critical finding
- A report with request-and-response evidence and remediation notes
- A free retest of reported findings within the agreed window
- The audit log of the engagement, which stays with you
What sets the fee
- Size of the target
- Number of applications, hosts and API endpoints in scope.
- Roles and tenancy
- How many user roles and tenants need to be exercised.
- Environment
- Staging or production, and the rate limits we agree.
- Timeline
- The testing window and how soon you need the report.
Scoping quoteSample
Targets1 web app, 1 API
Hosts in scope3
Roles exercised3
EnvironmentStaging
RetestIncluded
FeeFixed, quoted after the call
A 30-minute scoping call is enough for a written quote.
Book a scoping callOn certifications
Formal certifications such as SOC 2 and ISO 27001 are on our roadmap, not yet in hand. What holds today is concrete: every engagement runs under written rules of engagement, inside your own environment, and the audit log stays with you.
Start withthe scope.
A 30-minute call, a written scope, a fixed quote. Nothing is tested until rules of engagement are signed.