Questions we get asked

With a 30-minute call. We talk through your environment, what is driving the work — an audit, a customer questionnaire, a migration, a board question — and what a good outcome looks like. If we are a fit, you get a written proposal with fixed scope and price. If we are not, we will say so and point you somewhere better.

A cloud security assessment or platform review usually runs two to four weeks from kick-off to report. Compliance readiness depends on how far you already are — commonly six to twelve weeks. DevSecOps work is longer, because it lands in your pipelines and has to survive contact with your delivery cadence. Virtual CISO is ongoing, with a three-month minimum.

For assessments and platform reviews, read-only access is enough — an IAM role, an Azure reader assignment, or a GCP viewer binding, scoped to what is in scope. We do not need write access, and we do not ask for standing credentials. Where you would rather not grant access at all, we can work from exported configuration, though the findings will be shallower and we will tell you where.

Yes, before anything sensitive is discussed — and we prefer to sign it early rather than late. Note that anything sent through this website is not confidential until that is in place, so keep the first message general.

No. The services scale from small businesses to enterprise, and the pricing ranges on our pricing page reflect that spread. What matters is whether the work is a fit, not your headcount. A twenty-person SaaS company chasing its first SOC 2 is a perfectly normal engagement.

AWS, Microsoft Azure, and Google Cloud. Most engagements involve one; where you run more than one, we price each additional platform at a reduced rate, because the methodology carries over and only the provider's native tooling changes.

SOC 2, HIPAA, PCI DSS, NIST CSF, ISO 27001 (with 27017 and 27018 for cloud), CIS Benchmarks, and the CSA Cloud Controls Matrix. If your buyers or regulators are asking about something outside that list, tell us — we will say honestly whether we are the right people for it.

No, and no one should do both. Certification audits must be performed by an independent accredited auditor; if we prepared your controls and also audited them, the result would be worthless. We get you ready — gap analysis, control design, remediation, evidence — and work alongside the auditor you choose.

Tools like those collect evidence and track controls continuously, and they do it well. What they cannot do is design your architecture, judge whether a control actually reduces risk, or argue a position with an auditor. The two work well together: the platform keeps evidence current, we make sure what it is evidencing is sound. We are happy to work alongside whichever one you use.

Not as a standalone service. Our work is architecture-led — we look at how the environment is designed, configured, and governed, which finds a different class of problem than a time-boxed test against a running target. The two complement each other, and we will tell you when a pen test is the thing you actually need.

Because the honest answer to "what does this cost" depends on the size and condition of your environment, and a single number would be misleading in both directions. The range shows where typical engagements land. The estimator on the pricing page narrows it using your inputs, and the proposal after our call is the figure that binds.

Deliverables are listed per service on the services page, but the shape is consistent: a findings report with risk ratings, a prioritized remediation roadmap with owners, and an executive summary someone can take to a board. Every finding comes with a realistic path to resolution, not just a severity label.

We tell you immediately, not in the final report. Anything that represents active or imminent exposure goes to your named contact the same day, with enough detail to act on and a suggested containment step. Whether you then want us involved in remediation is your call.

Both are available. Assessments and reviews are diagnostic by design, so the report is the deliverable. Remediation is scoped separately, either as a project or through a Virtual CISO retainer where we oversee the work your team does. We would rather your engineers own the fix and understand it than hand it back as a black box.