Every project is fixed-fee after a short scoping call. As a rough guide, focused penetration tests and cloud hardening reviews typically land in the low four figures, while readiness projects and vCISO retainers are scoped monthly. You will know the full price before any work starts.
Penetration tests and cloud reviews usually run one to three weeks. Compliance readiness takes four to eight weeks depending on your starting point. vCISO engagements start with a 90-day plan on a monthly retainer.
Both. Most testing and advisory work is remote, serving clients across the US. Seattle-metro clients can get on-site kickoffs, walkthroughs, and workshops when they help.
Every finding includes reproduction steps, business impact in plain language, and concrete remediation guidance, ranked by what an attacker would exploit first. Executives get a summary they can use for risk and budget decisions.
Yes. One round of fix verification is included in every engagement, so remediation actually closes instead of lingering into the next audit.
SOC 2 and ISO 27001 readiness are the core focus, plus support for customer security questionnaires and cyber-insurance requirements. If you are chasing a specific audit date, say so on the first call and we will plan backward from it.