You're not ready for a full-time CISO and you might never be. What you need is someone senior who owns the outcome, shows up every month, and handles the things that keep landing on whoever happens to be closest. That's a retainer: a $2,500 assessment to start, $5,000 a month for the program, and the full price list is below.
Nobody ran a procurement process for this. Someone signed up for a chatbot, it worked, and word got around. By now customer lists and contracts have probably been pasted into tools no one at the company has reviewed. That is the risk profile of most small companies right now, whether or not anyone has looked.
We find which AI tools are in use across browsers, extensions, endpoints and your SaaS estate, and which accounts they were signed up with. The inventory is usually a surprise, and it is the fastest thing we can give you.
An acceptable use policy written in plain English, an approval path for new tools, and training that covers what staff now face: cloned voices on the phone, video that looks like the CEO, and phishing emails with no spelling mistakes to give them away.
Data loss prevention around AI tools, least-privilege access to anything AI can reach, and vendor review of the AI features your existing suppliers quietly switched on last year without asking you.
Copilot and Gemini don't create new permissions; they surface the ones your tenant already has, including every sharing mistake since it was set up. Cleaning that up before the rollout is a small job, and Microsoft's own guidance says to do it first. We check it before anyone switches the assistant on.
AI questions are showing up in enterprise security questionnaires, and auditors are now asking for evidence of data-flow controls around AI integrations. A policy saying "don't paste customer data into ChatGPT" gets no credit as a control. If you sell to anyone larger than you, this is about to become a sales problem.
Prices are listed rather than quoted on request.
The path most companies take is assessment, then roadmap, then retainer, and there's no obligation to move along it. Retainers run month to month after an initial term. Monitoring, endpoint and identity detection, and email security are quoted on top depending on your environment, because those costs depend on how many users, endpoints, and mailboxes you have.
CISA makes this point about smaller organizations: you may not have a formal CIO or CISO, but those functions still have to be owned at an executive level by somebody. In practice they get spread across several people, and things end up half done.
A named person, in your monthly leadership meeting, accountable for the answer when a client, an insurer or your board asks a hard question.
Enterprise security reviews get answered by us, on your behalf, with evidence attached. For a firm selling to larger customers, this is often the fastest return on the retainer.
We prepare the renewal and validate the controls you're attesting to, so the policy you're paying for responds when you need it.
We work alongside whoever runs your systems rather than replacing them. In practice that means a kickoff call with your provider, agreed lines on who owns what, and no reselling of what they already sell you. They keep things running; we're accountable for whether it's defensible.
We work best with businesses between roughly ten and five hundred people, where somebody owns technology as part of a broader job and nobody owns security outright.
Law firms, accounting practices, consultancies. You hold your clients' most sensitive material, and increasingly they're the ones asking you to prove you can protect it.
Local television, radio, digital news and production houses. If the broadcast chain is compromised, the failure happens on air.
Foundations, associations, community organizations. Donor data and grant records, defended on an overhead budget everybody scrutinises.
Dental groups, therapy practices, billing companies, medical suppliers. HIPAA applies to you, and most practices have never had anyone walk them through what it requires.
Independent advisors, agencies, mortgage brokers, lenders. The FTC Safeguards Rule reaches further than most owners expect, and enforcement has picked up.
Franchises, clinics, dealerships, regional service companies. Every location is its own network, and the ones nobody visits tend to have the oldest equipment.
The same five failures show up in company after company, and none of them are exotic. This is where an assessment looks first.
Security lives with an office manager, a founder, or an outsourced help desk whose contract covers uptime and nothing else.
Microsoft 365 and Google Workspace arrive configured so everything works for everyone on day one. Years later, legacy sign-in is still enabled and sharing is still wide open, because nobody was ever asked to change it.
Nobody approved it, nobody inventoried it, and the accounts it runs on aren't company accounts, which means there's no logging and no way to get the data back.
A client sends a questionnaire, or an insurer asks for evidence, and suddenly a framework you'd never heard of is a condition of doing business.
Most companies have backups. Fewer have tested a restore in the last year, and the first test usually happens during an incident.
$2,500, ten business days, and a ranked list of what to do. If you want us to execute the roadmap afterwards we'll talk about a retainer. If you'd rather take it to someone else, the report is still yours.
