Contract services
Tailored security services built around lasting client relationships, continuity, and measurable improvement.
A long-term security partner
Built for relationships, not short-term engagements
We invest in understanding your organisation, your systems, and your security priorities. Our service contracts begin at one year, equivalent to 2,000 hours. We do not offer three- or six-month service engagements.
- Initial consultation
- $5,000
- Standard hourly rate
- $150 per hour
- Minimum service contract
- 1 year / 2,000 hours
The initial consultation defines priorities and engagement scope. Services are tailored and billed hourly at the standard rate, with scope-specific pricing for longer-term agreements.
Selected: 1-year engagement / $300,000 total.
All amounts are in USD. Final scope, included hours, hourly billing arrangements, consultation-fee treatment, payment schedule, and any additional work are confirmed in a written service agreement. Multi-year totals are engagement prices, not annual fees.
Detection engineering, response and service assurance
Use Case Development, Alert Response and Managed Service Oversight
Turn security telemetry into actionable detections, consistent triage, and coordinated response. We work with corporate security teams and Managed Service Providers (MSPs) to strengthen detection quality, improve response, and maintain agreed service levels.
Use Case Review and Development
Review existing detections and develop use cases around your business risks, assets, and threat priorities.
- Validate the purpose, data sources, telemetry quality, and ownership of each use case.
- Develop and tune correlation rules, thresholds, enrichment, and suppression logic to reduce false positives while preserving meaningful detections.
- Test detection behaviour with agreed scenarios and document expected alerts, investigation steps, and acceptance criteria.
MITRE ATT&CK Mapping
Connect use cases to relevant adversary tactics, techniques, and sub-techniques, making detection coverage explicit.
- Map detections to observed behaviours and the telemetry needed to identify them.
- Separate a documented mapping from a tested detection so coverage reflects verified capability.
- Identify gaps, overlapping rules, and priority opportunities for new or improved use cases.
Alert Triage and Remediation
Give analysts repeatable investigation and response steps, with clear decision points and escalation ownership.
- Enrich alerts with host context, account telemetry, authentication activity, and asset criticality.
- Define severity, evidence collection, escalation criteria, and handoffs between internal teams and service providers.
- Document containment, remediation, recovery validation, and closure evidence in actionable runbooks.
Automated Orchestration Where It Adds Value
Build and validate orchestration playbooks for repeatable actions, using automation where the evidence, authority, and operational context support it.
- Coordinate host isolation and release through approved endpoint integrations.
- Collect and correlate account telemetry to support identity investigations and response decisions.
- Apply approved access control list (ACL) updates with validation, expiry or rollback, and an action log.
- Use least-privilege access, agreed approval gates, exception handling, and recovery steps for disruptive actions.
Thoughtful, Critical MSP Oversight
We work alongside corporate customers and their Managed Service Providers, and directly with MSP teams. Our oversight is collaborative, constructive, and rigorous: we challenge weak evidence, unclear ownership, and recurring service gaps while building effective working relationships.
We track Service Level Agreement (SLA) performance, hold delivery teams accountable to agreed commitments, and drive corrective action when service levels slip.
- Review agreed coverage, severity definitions, response targets, escalation paths, and reporting responsibilities.
- Validate SLA reporting against timestamps, ticket history, investigation quality, and response evidence.
- Monitor acknowledgement, triage, escalation, and remediation milestones against the applicable agreement.
- Track breaches and recurring issues through named owners, corrective actions, and regular service reviews.
Use cases, playbooks, authorised actions, integrations, and SLA review responsibilities are defined in the engagement scope. Production actions follow the customer's agreed authorisation and change-control process.
CIS-based configuration assurance
Benchmark Testing and Pre-Audit Assessment
Assess your environment against relevant CIS Benchmarks and build an evidence-backed readiness plan before your external audit.
Benchmark Testing
Secure-configuration testing against an agreed product, benchmark version, and profile.
- Inventory in-scope assets and identify applicable configuration recommendations.
- Agree the profile and operational impact, including Level 1 or Level 2 where defined by the selected benchmark.
- Combine automated checks, where supported and appropriately licensed, with manual verification.
- Record findings, evidence, applicability, and approved exceptions rather than presenting a score without context.
- Prioritise remediation and retest agreed changes without making unapproved production changes.
Pre-Audit Assessment
A structured review of configuration gaps and supporting evidence against your agreed audit scope.
- Review configuration baselines, change records, and the evidence your audit requires.
- Trace each in-scope finding to its benchmark recommendation and affected assets.
- Identify missing evidence, unresolved risks, and exceptions requiring an owner or approval.
- Prepare an evidence index and a prioritised action plan with remediation owners.
- Review remediation evidence and highlight residual gaps before the external assessment.
What you receive
- Scope and baseline
- Asset coverage, benchmark versions, selected profiles, and exclusions.
- Findings register
- Configuration results, manual-review items, risk priorities, and exceptions.
- Evidence pack
- Recommendation references, dated evidence, and an audit-ready evidence index.
- Readiness plan
- Remediation actions, accountable owners, retest results, and outstanding gaps.
Technology coverage
Scope is selected from the CIS catalogue for your actual products and versions, including:
- Operating systems and server software
- Cloud platforms and workplace applications
- Network and storage devices
- Containers, orchestration, and DevSecOps tools
CIS Benchmarks provide secure-configuration recommendations; this is not performance testing. Benchmark materials and assessment tools are used only under applicable licences and agreed permissions. This is an independent readiness assessment, not a CIS certification or a guarantee of an audit outcome. Your external auditor determines whether the evidence meets their requirements.
Contact our team to scope your tailored service engagement.