Straight answers, including the awkward ones

It depends on scope, and we scope before we quote. For penetration testing the drivers are the number of live hosts and applications, whether internal and external perspectives are both needed, and whether social engineering is in scope. For compliance work the dominant driver is the size of your CUI boundary. For managed security it is the size of the estate and the telemetry in scope. Our OSCP training prices are published in full because they do not vary.

Because the honest range is wide enough to be useless and narrow enough to mislead. We would rather give you a real number after a thirty-minute call than a range that turns out to be wrong for your environment. The call is free and carries no obligation.

A focused assessment such as a Microsoft 365 review is usually one to two weeks from kickoff to report. A penetration test is typically two to four weeks depending on scope. A CMMC readiness assessment depends almost entirely on how quickly your team can produce evidence. We give you a duration in writing before you commit, and we tell you if it slips.

Not publicly. Most of our work is covered by non-disclosure terms, and a small firm listing logos it cannot substantiate is making a claim it cannot defend. References and past performance detail are provided directly during a procurement, where they can be given in context and verified.

No. We hold no vendor partner tier and take no reseller margin. A recommendation to configure something you already own is a normal outcome and costs us nothing to make.

No, and neither can any firm that also prepares you. CMMC Level 2 certification is issued by an authorized third-party assessment organization that must be independent of whoever did the readiness work. Treat any provider offering both as a serious red flag.

Thirty minutes with the engineer who would run the work. You describe the environment, the obligation, and the deadline. We tell you what we would do, in what order, roughly how long it takes, and what drives the price. Afterwards you get that in writing. If the right answer is that you do not need us yet, we say so on the call.

Yes, and it happens regularly. Often the real answer is to fix a configuration you already pay for or to turn on logging you already license. That outcome costs us an hour and saves you a procurement cycle, and you are considerably more likely to come back.

Our focus is United States federal, state, defense, and commercial work. We take inquiries from elsewhere but will tell you if a local firm is better placed, particularly where data residency or local regulation is central to the requirement.

That the people who write our detection content are the same people who run our red team engagements. It is not a positioning phrase: it shows up as detections mapped to specific MITRE ATT&CK techniques, and as defensive recommendations that come from having taken the path rather than from a product datasheet.

Report it on our contact form under "Incident response"; those are triaged ahead of everything else. Before we speak: isolate affected systems rather than powering them off, stop anyone wiping or rebuilding, and preserve logs immediately, especially cloud and identity logs with short retention. Evidence destroyed in the first hour cannot be recovered, and without it you cannot establish scope.

Yes, for penetration testing engagements. Once you have remediated we retest the findings and reissue the attestation. We consider billing separately for this to be a poor practice, because it discourages the remediation the test existed to produce.