For 12 months, we test the attack paths into one critical business unit, prove every fix and monitor what changes. Your leaders get evidence they can act on.
| Layer | Review 1 | Review 2 | Review 3 | Review 4 | Monitoring |
|---|---|---|---|---|---|
| AI agents | Planned | Planned | On | ||
| Customer apps | Tested | Retested | Planned | On | |
| Partner integrations | Tested | Exception | On | ||
| Identity and sign-on | Tested | Retested | On | ||
| Cloud accounts | Tested | Retested | Planned | On | |
| Data stores | Tested | Retested | On |
- Price · USD
From$25,000USD / year
Starting price. We agree the final fee before work begins.
- Term
12 months
Billed once a year
- Monitoring
Included
For the full 12-month term
- Best for
Large and regulated organisations
Enterprise security program
The year
A year of work, planned with you.
Twelve months, with four reviews and retests, quarterly risk reviews and one incident response exercise. Monitoring runs for the whole term.
Agree the scope and the risks first. We map the business unit with your sponsor, technical lead and risk owner. Then we set the review plan for the year.
Four reviews, each followed by a retest. Every review ends with findings and owners. The retest shows which fixes held, and we record any exceptions you accept.
Practise a bad day before it happens. Once a year we run a realistic incident exercise with your team. You leave with a readiness plan.
Evidence your board can act on. The leadership pack shows what we tested, what changed and what risk remains, in plain language.
We keep watching what changes. Monitoring runs for the full term. We alert your technical and risk owners when something needs action.
Year plan · Example
Payments business unit
- In scope
- 3 applications · 2 cloud environments
- Top risks
- Contractor access · shared admin roles · partner API tokens
- Reviews
- Q1 identity · Q2 customer apps · Q3 integrations · Q4 AI agents
- Sign-off
- SponsorTechnical leadRisk owner
Roles
Clear roles on both sides.
We agree who does what before the first test, so nothing waits on an owner.
You provide
- An executive sponsor, a technical lead and a risk owner
- The business unit, applications and cloud environments in scope
- Written permission, test windows and escalation contacts
- Engineers and deployment owners who can make fixes
- Monitoring access or data feeds, alert contacts and who to call when something is urgent
We deliver
- A clear scope, a risk register and a review plan for the year
- Findings, retest results and recorded exceptions
- Quarterly reports with priorities and owners
- A leadership evidence pack and an incident readiness plan
- Monitoring findings, alerts we raised and next actions for the full term
Scope
One business unit, covered for a year.
For organisations that need regular testing of critical systems and evidence for leadership. Final scope depends on how complex your systems are.
Included in the annual fee
- One business unit, up to three applications and two cloud environments
- Four focused security reviews during the 12-month term
- Attack paths through identity, platforms, applications and integrations, chosen with you
- A retest after each review
- Quarterly risk reviews with your stakeholders
- One leadership evidence pack and one incident response exercise each year
- Ongoing monitoring of your systems for the full term, with alerts sorted and sent to your contacts
Built forLarge and regulated organisations · Financial groups with complex security needs · Teams running a critical business unit or service
Questions from security and risk leaders.
Does $25,000 cover every system we own?
No. The starting price covers one business unit with its applications and environments. We quote wider estates against a clear scope.
Is incident response included?
One incident response exercise is included. Live incident response and response retainers need a separate agreement.
Can we add specialist AI testing?
Yes, as an extension. We scope testing of AI agents and models around the systems your business unit runs.
Who needs to be involved on our side?
An executive sponsor, a technical lead and a risk owner, plus engineers who can make the fixes.
Is ongoing monitoring included?
Yes. We monitor the systems in scope for the full 12-month term. We agree access, reporting, contacts and triage hours before it starts.
Enterprise Security
Show your board what's protected.
Tell us about the critical service, the business unit and who makes decisions. We agree the plan, responsibilities and annual fee.