Assessment
Fixed fee. Fixed deliverable. The way to find out what you actually have.
- Single facility or digital estate
- 2–3 weeks from access
- Findings register + ranked plan
- No obligation to continue
Home/Engagements
How we work
Engagements
A security engagement should make your organization harder to hurt and your staff harder to fool. It should not make you dependent on a consultant. Here is exactly how the work runs, what it costs to find out, and what we need from you.
01/ METHOD
Five phases, no surprises.
Each phase ends with something you can read and act on. If a phase does not produce a decision, we have wasted your money.
Phase 01
Intake
Written request, then a 20–30 minute call. We establish what is happening, what has been tried, who owns the risk and what a good outcome looks like. If we are the wrong firm, we say so here rather than after an invoice.
Output · written go / no-go + first-step proposal
Phase 02
Assessment
On-site walkthrough and remote review running in parallel. Physical: entrances, sightlines, access control, guard practice, camera coverage. Digital: attack surface, identity, email authentication, endpoint baseline, backup reality. Interviews with the people who actually run the building.
Output · findings register with severity and evidence
Phase 03
Design
A ranked remediation plan, costed in money and staff time. Quick fixes that can be done this week are separated from projects that need a budget cycle. Every recommendation names the risk it reduces and what happens if you accept it instead.
Output · ranked fix list + board-ready summary
Phase 04
Implement
We do the technical work we are engaged to do — configuration, policy, hardware, training — and coordinate the trades we do not (locksmiths, integrators, glaziers, counsel). Nothing is signed off until it has been tested.
Output · verified remediation + handover documentation
Phase 05
Sustain
Optional retainer: quarterly re-test, monitoring, drills, on-call escalation and lab support. The measure of a good retainer is that your team needs us less each quarter, not more.
Output · quarterly posture delta
02/ COMMERCIAL
Three ways to buy.
Fees are quoted per scope. We do not publish a rate card because a synagogue with one building and a multi-site institution are not the same problem — and pretending otherwise would mean overcharging one of them.
Project
Remediation, deployment or a build with a defined end state.
- Scoped statement of work
- Milestones and acceptance tests
- Hardware and configuration included
- Handover and training at close
Retainer
Standing protection: monitoring, re-testing and escalation.
- Quarterly posture review
- Monitoring and threat briefings
- 24/7 escalation for incidents
- Lab and field-tech support
Nonprofits & congregations
Assessment fees for congregations, schools and registered nonprofits are quoted on a
reduced schedule. Ask at intake — the work does not change, only the invoice.
03/ EXPECTATIONS
What we need
from you.
Most failed security projects fail at access, not at analysis. These are the things that make the difference between a report that sits in a drawer and one that changes how the building operates.
One owner with authority
A single named person who can approve access, sign for scope changes and carry the findings to the board. Committee-only sponsorships stall at phase three.
Honest access
Keys, badges, admin credentials and the unvarnished story of what has already happened. An assessment built on a sanitised version of events is a decoration.
Willingness to hear it
Some findings are uncomfortable — a volunteer with too much access, a leader whose home address is public, a camera that has never recorded. They get fixed or they get accepted in writing.
A decision, not a discussion
At the end of each phase there is a choice: proceed, pause or stop. We will give you the recommendation and the reasoning; the decision stays yours.
What we will not do
We will not inflate a threat picture to sell a retainer. We will not recommend a product we
are paid to resell. We will not sign an NDA that prevents us from telling you the truth
about your own organisation, and we will not accept an engagement where the client intends
to use our findings against a person rather than a risk.
Begin
Twenty minutes
is enough to know.
The intake call is free. It is also where we will tell you if you do not need us.