The bread and butter. Most engagements are 2–4 weeks; larger applications go longer.
Typical range: $28k–$85k depending on scope. Fixed price, not day rate. We scope carefully so we don't have to change the invoice.
Where automated tooling stops and human judgment starts.
Automated CSPM tools (Prisma, Wiz, Orca) will catch the obvious S3 bucket. They will not catch a cross-account trust chain that lets a compromised Lambda in your staging account assume a production role that lets it drop tables. We hunt for the latter.
Coverage: IAM privilege paths, resource-based policies, KMS key policies, VPC design and network segmentation, secrets management, logging/monitoring integrity, container and Kubernetes security, CI/CD pipeline security.
Deliverable: Priority-ranked findings with Terraform snippets showing the exact remediation. We do not hand over a scanner report and call it a review.
Objective-based adversary simulation. Real threat-actor TTPs, real business impact.
Red teaming is not "hack whatever you find." Every engagement starts with a specific objective — exfiltrate CI/CD signing keys, escalate to domain admin, gain read access to the customer database. We work backwards from that objective and stop when we hit it, so you get a clear yes/no answer.
Engagement types:
Rules of engagement are agreed in writing before we start. Anything outside them is off-limits. We name the specific individuals authorized to stop the engagement at any time.
Manual review of security-critical paths, supplemented (not replaced) by SAST.
Best used for: cryptographic implementations, authentication and authorization code, session handling, deserialization, WebSocket handlers, and any code path handling untrusted input from external sources.
Languages we work with routinely: Go, TypeScript/JavaScript (Node), Python, Ruby, Java, Kotlin, Rust, and C#. Ask about others.
Best done during design — before you build the thing.
Facilitated STRIDE workshops with your architects and product team. We come out with an attack tree, prioritized list of threats, and specific mitigations mapped to your backlog. Typical timeline: 1 week of prep, 2 days on-site or over video, 1 week for the write-up.
Because when it happens, you don't have time to procure.
Included in every retainer:
Not included: Actual incident response hours. Those are billed at the discounted retainer rate ($385/hr instead of standard $560/hr) when an incident happens.
Retainer pricing: $18k–$60k annually depending on organization size and SLA requirements.