Engagements are priced based on scope, not day-rate. For assessments we provide fixed-price quotes after a short scoping call. Retainer and vCISO services are monthly. We don't publish rate cards — every engagement is scoped precisely so you pay for what you actually need, not a padded estimate.

It starts with a 30-minute scoping call to understand your environment and goals. We then provide a written proposal with scope, methodology, deliverables, and timeline. Once approved, we begin with a kick-off, run the engagement, and deliver a report with findings and prioritized remediation guidance. We include one remediation review cycle at no extra cost.

A focused web application penetration test typically takes 3–5 business days. A full LLM security assessment runs 5–10 days depending on the number of models and integrations in scope. EU compliance gap assessments (e.g., DORA, NIS2) are typically 2–4 weeks. vCISO and retainer arrangements are ongoing. We'll give you a clear timeline in the proposal.

Yes — EU compliance is a primary service. We cover EU AI Act, DORA, NIS2, CRA, CSA, ISO 27001, ISO 17025, and PCI-DSS. We perform gap assessments, help with remediation planning, and can provide evidence-ready documentation. Our approach focuses on practical readiness, not checkbox compliance.

Three models: (1) Fixed-price assessment packages for well-scoped projects like pentests or compliance gap analysis; (2) Project-based engagements for custom or multi-phase work; (3) Monthly retainer for ongoing advisory, vCISO services, or continuous security support. We can also combine models — for example, an initial assessment followed by a retainer.

Yes. Startups building AI products or operating in regulated EU sectors are a core client profile. We offer startup-focused advisory services that are right-sized for early stage — focused on the most critical risks, building security foundations that scale, and positioning for enterprise sales or regulatory scrutiny. See our Startup Advisory page for details.