Reviews and implementations with defined scope to understand risk, organize evidence and build controlled AI, automation or data workflows.
Short review to organize an uncertain situation before proposing broader work.
Not included: pentest, full forensics, remediation or certification.
Review for evaluating a vendor, acquisition, investment or integration before committing.
Not included: formal audit, deep exploitation, legal opinion or remediation.
Review for AI systems connected to documents, tools, internal data or automations.
Not included: full build, model training or legal approval of AI providers.
Implementation of concrete workflows when process, owner, available data and acceptance criteria are clear.
Not included: open-ended development, unlimited support, uncontrolled autonomous agents or fragile scraping.
Review to answer enterprise customers, prepare an audit or close evidence gaps.
Not included: certification, official audit or guaranteed enterprise approval.
Practical exercise to review roles, decisions and communication before a real incident.
Not included: 24/7 response, full forensics, continuous monitoring or breach legal advice.
Ongoing guidance after an initial review, with defined hours and responsibilities.
Not included: daily support, unlimited execution or incidents outside contract.
| Offer | Decision enabled | Typical duration | Fit |
|---|---|---|---|
| Rapid Risk Triage | How serious is this and what should we review first? | 2-3 days | Initial urgency, questionnaire, suspicious vendor or AI initiative. |
| Due Diligence | Do we proceed, ask for more evidence or pause? | 7-10 days | Vendor, M&A, procurement or enterprise onboarding. |
| AI Risk Review | Can we deploy AI with reasonable controls? | 5-10 days | LLM, RAG, agents, copilots or automations with data. |
| Scoped implementation | Which workflow should we build and how do we leave it operable? | 2-6 weeks | Applied AI, integrations, reports, evidence and repetitive processes. |
| Readiness | What evidence is missing for enterprise or audit review? | 10-20 days | B2B SaaS, tech vendors, audits or security reviews. |
| Incident Tabletop | Who decides what during an incident? | 7-12 days | Companies with sensitive data or critical continuity. |
Before building, we validate process, frequency, data, risk, owner and success metric.
We implement one to three workflows with closed scope, testing, documentation and acceptance criteria.
Continuity is handled with hours, backlog and clear responsibilities. No implicit support.
We do not request access or sensitive evidence without scope and authorization.