Security and infrastructure consulting for regulated organizations
Fixed-fee assessments, incident response and compliance readiness, led by senior engineers. We don’t resell software or manage your IT, so we work alongside your team, finish the job and hand it back.
Focused consulting for work that’s too important to get wrong.
We don’t manage your day-to-day IT. We’re brought in for a specific job: an exam or audit, an incident, an insurer questionnaire or an infrastructure decision. We assess, architect, solve and advise, then hand it back to your team.
Fixed-fee, scoped work
Every engagement has defined deliverables, a timeline and a fee agreed before we start. We finish the work and hand it back, with no open-ended contracts.
Independent by design
We don't resell hardware, software or managed services. Our recommendations aren't tied to margin, and we work comfortably alongside your IT team or provider.
Senior engineers, start to finish
Engagements are led and delivered by the people who scope them. We don't sell senior and staff junior.
Engagements
Each one is scoped in writing before it starts: what we’ll do, what you’ll receive and what it costs.
2–3 weeks · Fixed fee
Security Posture Assessment
A full review of your Microsoft 365 tenant, identity configuration, email authentication and external attack surface.
Secure Score analysis
Conditional Access and MFA gap review
SPF, DKIM and DMARC audit
Prioritized remediation plan
Hourly · Minimum applies
Incident Response
Contain active threats, find out what happened and how far it reached, then harden so it doesn't happen again.
Containment and evidence preservation
Root cause and attack timeline
Post-incident hardening
Documentation for insurers and auditors
Fixed fee
Compliance Readiness
Preparation for an audit or regulatory exam: find the gaps, design the controls and assemble the evidence.
Framework gap assessment
Control design and documentation
Evidence collection
Readiness readout for leadership
4–8 weeks · Fixed fee
Infrastructure Architecture Review
A deep assessment of your current environment with vendor-neutral recommendations for risk reduction and modernization.
Current-state documentation
Single-point-of-failure analysis
Modernization roadmap and cost model
Cloud migration feasibility
Monthly
Strategic Advisory Retainer
Ongoing senior technical leadership as a fractional CTO or vCISO, without the cost of a full-time hire.
Regular strategy sessions
Technology roadmap
Vendor evaluation and selection
Briefings for leadership
Fixed fee
AI & HPC Infrastructure Design
Architecture and deployment planning for GPU compute, from power and cooling to cluster configuration and tuning.
Cluster architecture and capacity
Air- and liquid-cooled design
Scheduler setup (Slurm, PBS)
Performance monitoring
Built for organizations that answer to an examiner.
Our work is built for sectors where security is audited, not optional, and for the frameworks your examiners, insurers and partners hold you to.
Credit unions & community banksGLBANCUA / FFIEC exams
HealthcareHIPAA
Energy & utilitiesNERC CIP
Oil & gasInsurer & partner requirements
Medical device manufacturingFDA 21 CFR Part 11
Government contractingCMMCNIST SP 800-171
Technology & SaaSSOC 2PCI-DSS
How an engagement works
Four steps, and the price is set at step two.
1
Discovery
A 30-minute conversation about your environment, what's at stake and what a good outcome looks like.
2
Scope & proposal
A written proposal with deliverables, a timeline and a fixed fee. You know the cost before work begins.
3
Execute
Senior engineers do the work: assessment, architecture, implementation or investigation.
4
Deliver & hand off
Documentation, an executive readout and knowledge transfer. Your team owns the result.
Start with a free Microsoft 365 security review
Twenty minutes, no charge and no obligation. You’ll see where your configuration stands and what to fix first, whether or not you work with us afterwards.
We don't manage your day-to-day IT. We're brought in for specific, high-stakes work: security assessments, incidents, compliance readiness, architecture and technology strategy. Then we hand it back. Because we don't sell managed services, we work comfortably alongside your existing IT team or provider.
A 20-minute working session, at no charge. We look at Secure Score, email authentication, Conditional Access, MFA coverage and privileged identity configuration, then give you a short, prioritized list of fixes. There's no obligation to engage us afterwards.
We price by engagement, not by the hour. Assessments, architecture reviews and compliance programs are fixed-fee with defined deliverables. Advisory retainers are billed monthly. Incident response is the exception: it's billed hourly with a minimum, because its scope can't always be predicted.
It starts with a discovery call, then a fixed-fee proposal. A security assessment typically takes 2–3 weeks; an architecture review usually runs 4–8 weeks. Retainers are ongoing and monthly.
We're based in Portland, Oregon and work with organizations across the United States. Most work is delivered remotely; incident response and engagements that need a physical presence can be done on site.
Yes. We handle active incidents and post-incident reviews: containment, investigation through Microsoft 365 and cloud admin tooling, root cause analysis and hardening, with documentation you can share with your insurer, auditors or regulators.
Let’s talk about what’s at stake
Request the free review, or tell us about an exam, audit, incident or project. Every message is read and answered by our team.