How we work with you

Six ways to work with us, scoped to what you need

Built for companies that ship software but don't have a full security team. Every engagement runs on products we build and operate ourselves, and is scoped with you on a call.

A typical path

  1. 01

    Test

    A pentest or assessment shows where you actually stand.

  2. 02

    Keep testing

    Recurring or continuous testing and managed AppSec catch what each release changes.

  3. 03

    Engineer

    We build the missing controls with your team.

  4. 04

    Lead

    A fractional CISO owns the programme and the audits.

Start wherever you are. Each engagement also stands on its own.

01 · Solution

Compliance Pentest

A scoped pentest of your apps, APIs, cloud or network, with a report your auditor or enterprise buyer can file.

Compliance Pentest: how it runs → Scope this with us

02 · Solution

Recurring & Continuous Pentest

Manual pentests on a cadence you choose, with scanning and agentic testing in between.

Recurring & Continuous Pentest: how it runs → Scope this with us

03 · Solution

Managed AppSec & Detection

We run application security for you, from detection to fixes your team approves.

Managed AppSec & Detection: how it runs → Scope this with us

04 · Solution

Agentic AI Security

Assess, test and control the AI agents, MCP servers and LLM features you run.

Agentic AI Security: how it runs → Scope this with us

05 · Solution

Security Engineering Projects

Fixed-scope projects where we build the controls with your team and hand them over: pipelines, access, supply chain and cloud. You end up with controls your engineers can run.

For: Teams that know what is missing and need senior engineers to implement it.

Runs on Acksess Chainsaw DSO
Scope this with us

What's included

  • DevSecOps: security checks in pull requests, pipelines and deployments
  • Zero Trust access to replace your VPN
  • Supply-chain controls, SBOMs and package policy
  • Cloud configuration and IAM hardening
  • Documentation and handover to your engineers

Related services

DevSecOps Zero Trust Architecture Cloud Configuration Review

06 · Solution

Fractional CISO

Security leadership without a full-time hire, led by our CEO.

Fractional CISO: how it runs → Scope this with us

Pricing

How engagements are priced

We don't publish a rate card, because no two estates are the same. Every engagement is quoted after a scoping call, based on what we would actually test.

You receive a written proposal with a firm quote before any work starts. Any change in scope is agreed with you in writing first.

What the quote is based on

  • The applications, APIs and environments in scope
  • The depth of testing
  • Whether it runs once, on a recurring cadence or continuously

What happens after the call

  1. 01

    Scoping call

    You talk it through with the engineers who would do the work.

  2. 02

    Written proposal

    Scope, approach, deliverables and a firm quote, in writing.

  3. 03

    Kickoff

    Once the proposal is signed, we agree the rules of engagement in writing and start.

How we test, handle your data and use AI is set out on our Trust page.

Looking for something specific?

All 26 services

Red teaming, smart-contract audits, IT/OT testing, training and more are available as standalone engagements.

Browse all services →

Book a call

Book a 30-minute call

Pick a time that suits you. We'll talk through what you're building and where your security stands, then suggest where to start.

Cyphlon

1:1 Consultation Call

30 min Google Meet

An introductory call with our engineers about any engagement: a pentest, continuous testing, managed AppSec, security engineering, agentic AI security or a fractional CISO. We'll ask about your stack, your deadlines and what your customers or auditors expect, and tell you plainly if we're not the right fit.

Or open the booking page on Calendly