// Engagement tiers
Each tier is a natural precursor to the next. You don't need to commit to a full exercise to get value. The posture score is free. The assessment is fast to procure. The full exercise is built on real data, not assumptions.
Tier 1
Free Automated Posture Scoring
$0
No credit card. No sales call.
A self-service tool that maps your environment against known attack patterns and scores your defensive coverage. Output is a scored gap report. This is the starting point - understand where you actually stand before deciding whether to go further.
Tier 2
Posture Assessment
~$5000
Fixed rate. Fast to schedule. Discounts for small business available.(<100)
A practitioner-led deep dive into your environment using real data - hosts, controls, crown jewels, exposure surface. Produces a detailed gap analysis mapped to your actual attack surface. Low procurement friction. Natural precursor to a full exercise.
Tier 3
Full Tabletop Exercise
$10K–$20K
Scope and environment complexity dependent.
A full facilitated incident response exercise built from your environment data. Scenarios are constructed before the exercise. The exercise itself is designed to find where your team actually breaks down - not to produce a passing grade.
// Pilot engagements available for early clients at a reduced rate. If you're evaluating us for the first time and want to run a scoped exercise before committing to full pricing, reach out. We'd rather earn your trust with a real engagement than ask you to take it on faith.
// How the tiers connect
The free posture score tells you where your environment has obvious gaps against known attack patterns. The Tier 2 assessment takes that signal and turns it into a detailed, practitioner-validated gap analysis using your actual data. The Tier 3 exercise takes that gap analysis and builds an exercise scenario around the most significant failure modes - so you're not running a generic scenario, you're running one constructed around how your specific environment breaks.
Most clients start with Tier 1 or Tier 2. The Tier 3 exercise is significantly more valuable when preceded by a Tier 2 assessment because the scenario construction is more precise. You can still engage at Tier 3 without a prior assessment - we'll do the environment intake as part of scoping - but the Tier 2 path is faster and produces a better exercise.
// Clarity on scope
We do not tailor exercises to produce outputs for a specific compliance framework. If your primary need is a documented exercise artifact for an audit, we are probably not the right fit. We can refer you to firms that specialize in that work.
We will not tell you the exercise went well if it didn't. If you need the exercise to produce positive results for internal stakeholders regardless of outcome, that is a different product than what we offer.
We do not run the same exercise for every client. The scenario is constructed from your environment. If you want an off-the-shelf scenario dropped into your conference room, there are many vendors who offer that. We are not one of them.
We have opinions about tools and controls. We will share them honestly. We are not in the business of maintaining diplomatic neutrality about whether your current security stack is actually protecting you.
// Get in touch
Tell us about your environment, your team, and where you are in the process. We'll respond with a clear answer on what makes sense - and whether we're the right fit.
→ No pitch deck to sit through
→ No NDAs required to have a real conversation
→ We'll tell you if we're not the right fit
Tell us about your environment, team size, tools deployed, and what you're trying to understand or improve. We respond to every message directly.
Start the Conversation →Or email us directly: [email protected]