How an engagement actually works, end to end.
Six steps. The first is a 30-minute call, not a sales pitch. The last is a 90-minute quarterly review that asks: what changed, what got worse, and what should we focus on next?
- 01Discover
30-minute call with a practitioner
Not a sales person. You tell us what's going on; we tell you whether we're the right fit — and if we're not, we'll point you toward who is. No deck.
What you walk away with- Sanity-check on scope
- Framework-fit recommendation
- Rough timing & order-of-magnitude estimate
- 02Diagnose
Two-week risk assessment (most engagements start here)
Senior engineer interviews your team, reviews your stack, and runs targeted assessment work. You get a prioritized roadmap with executive readout and a tactical punch list.
What you walk away with- Executive risk readout
- Prioritized 12-month roadmap
- Quick-win remediation list
- Compliance gap map (if relevant)
- 03Scope
Right-sized statement of work
We propose the smallest engagement that solves your actual problem. We will say no to expanding scope just to close a bigger number.
What you walk away with- Fixed-scope SOW with named team
- Timeline with checkpoints
- Pricing transparent on the page
- 04Deliver
Senior team, weekly cadence
A named lead engineer runs the engagement. Weekly status with two questions: what changed, and what's blocked? No theater. Real artifacts shipped on schedule.
What you walk away with- Weekly status with decisions, not slides
- Pull requests, runbooks, and dashboards
- Direct slack channel with our team
- 05Operate
Hand off — or run it for you
Two paths after delivery: we hand over what we built and your team owns it, or we operate it for you on retainer. Many clients do both — internal ownership with our SOC behind it 24/7.
What you walk away with- Documented runbooks for handoff
- Optional retainer for ongoing operation
- Named on-call rotation if retained
- 06Review
Quarterly executive review
Every retainer client gets a 90-minute quarterly review with leadership: incidents trended, risk posture changed, controls coverage, and the next 90-day priorities.
What you walk away with- Risk-posture delta vs. last quarter
- Incident retrospective
- Roadmap reprioritization
What we won't compromise on
These are non-negotiable. If they sound wrong for your situation, we're probably not the right partner.
We start with a diagnostic, not a sale.
Most engagements begin with a two-week risk assessment. It's the cheapest possible way to find out if we're the right partner — and the right answer is sometimes 'not us'.
Named leads, not pooled juniors.
Every engagement has a single senior engineer who owns delivery. The team behind them is senior too — no offshored back-office, no fresh-grad churn.
We work in your stack.
We engineer Splunk, Sentinel, CrowdStrike, SentinelOne, Okta, AWS, Azure, GCP — whatever you already pay for. We don't have a platform to upsell.
We write things down.
Every engagement ends with documentation your team can own. Runbooks, decision logs, detection rules with comments. Nothing lives only in our heads.
Want to see if we're a fit?
Start with the 30-minute call. We'll be honest with you about whether to keep talking.
Book the call