← Security engineering & careServices, pricing & scope
A clear scope.
A clear price.
Know what you’re buying, what needs approval and what happens next. Start with a focused review or bring us findings that need fixing.
USD · Written agreement before work · No payment taken on this page
Choose your starting point
The work. The deliverables.
The boundaries.
01A clear place to start
Security Checkup
$495USD · one time
Understand the exposure around one business website and leave with a prioritized plan.
- One website, its source repository when available, and one hosting account.
- Up to four hours reviewing software versions, public configuration, access permissions and recovery readiness.
- Safe, non-destructive checks within your written authorization.
- Written findings with evidence, priorities, open questions and recommended next steps.
- One follow-up conversation about the findings.
Assessment and recommendations. Code repairs, account changes, deployment and recovery exercises are quoted separately.
Start with a checkup ↗02Turn findings into action
Fix & Harden
From $1,250USD · per engagement
Resolve agreed security issues and verify the changes through a controlled release.
- A written scope naming the issues, systems and acceptance checks.
- Dependency repairs, configuration changes or access cleanup as agreed.
- Testing on a separate copy or staging environment where available.
- An approved deployment plan with a recovery or rollback path.
- Verification results, remaining risks and operating notes.
Final price follows the findings and access review. The starting price is not an unlimited repair package.
Discuss the fixes ↗03For systems that do more
Application & AI Review
From $2,500USD · per review
A focused security engineering review of an application, API or connected AI workflow.
- An agreed application or workflow boundary and threat model.
- Source-backed review of the relevant identity, data and permission paths.
- Controlled validation of findings using safe test data and accounts.
- For AI workflows: untrusted content, tool permissions, sensitive data and approval boundaries.
- A technical report and an owner-friendly summary with a remediation plan.
The quote defines review depth and test coverage. Remediation, retesting beyond the agreed scope and formal penetration testing are separate engagements.
Scope a deeper review ↗04Keep the basics current
Security Care
From $249USD · per month
Scheduled care for one website after its initial review and required fixes.
- Monthly dependency, configuration and account-access review.
- Setup of supported dependency and availability alerts.
- Up to one hour of approved routine maintenance each month.
- A monthly summary of checks, changes and items needing a decision.
- A documented process for approving and scheduling larger fixes.
Initial checkup and remediation are separate. Unused maintenance time does not roll over. Alert handling and support hours are agreed in writing; this plan does not include continuous monitoring or 24/7 incident response.
Discuss ongoing care ↗Not sure which fits?
Start with what worries you.
“We haven’t checked the site in a while.”
Start with the Security Checkup. Get a defined review and prioritized findings before deciding on repairs.
“We already have security findings.”
Discuss Fix & Harden. We confirm the findings, agree the changes and quote the implementation.
“Our app or AI tool handles sensitive work.”
Scope an Application & AI Review around the relevant identity, data and tool-permission paths.
“We need someone to keep an eye on maintenance.”
Discuss Security Care after the initial review. The agreement defines the schedule and who responds to alerts.
Before you commit
Agreed before access.
Approved before change.
Send a short description first. We’ll confirm fit and availability, then provide a written scope and quote.
Ask about your project ↗- Scope and ownership. Named systems, review depth, access method and written authorization before testing.
- Fees and timing. Deliverables, final price, payment terms, applicable taxes and schedule before invoicing. Additional work requires approval.
- Existing costs. Hosting, software licenses, cloud usage and other provider charges remain separate.
- Production permission. Assessment does not authorize live changes. We agree on the release and recovery plan separately.
- Care terms. Billed monthly under the agreed terms. Initial review is separate; cancellation, support hours and alert handling are confirmed before enrollment.
- Specialist work. Formal penetration testing, compliance-readiness work and incident response need dedicated scopes. Certification and 24/7 response are not included in these packages.