How we work with clients.

A straight answer to the question most buyers ask second. The first one is “can you help?” This page answers the second one: “what does that actually look like?”

Most prospects who reach us have the same two questions. First, can you help with the thing we are dealing with? Second, what does that actually look like in practice? The first question is a conversation. The second has a real answer, and we think you deserve it before you ever get on a call with us. This page lays out the shapes our engagements take, how we scope them, how we price them, and what to expect if you decide to work with us.

The engagement models we offer

Most of our work falls into one of five shapes. They exist because, over years of running engagements, these are the structures that actually fit how security, compliance, and AI governance work get done inside real organisations. Many clients start in one model and move into another as the relationship matures.

Strategic advisory retainer

A fixed monthly retainer for trusted outside perspective at the executive level. You get ongoing access to a senior practitioner who learns your business, joins leadership conversations when it matters, and becomes the person you call when the board, regulators, customers, or your own team ask a security question you want a second opinion on. Best for organisations that need a trusted voice at the table without adding a permanent executive. Typical commitment: three to twelve months.

Fractional vCISO

A set number of days per month embedded in your leadership team as your acting Chief Information Security Officer. We run your security program, report to the board, own your security roadmap, make hiring recommendations, and represent security in your most important meetings. Best for growing companies that need a real security program but cannot yet justify a permanent CISO on the payroll. Typical commitment: six months minimum, often twelve months or longer, with a defined handover if and when you hire a permanent CISO.

Fixed-scope project

A defined piece of work with a clear start, clear end, and clear deliverable. This is the shape we use for ISO 27001 readiness, SOC 2 preparation, Essential Eight assessments, risk assessments, incident response plans, business continuity plans, third-party security reviews, and similar engagements. We scope and price these up front, so you know exactly what you are buying and exactly when you will have it. Typical duration: two to twelve weeks, depending on scope and complexity.

AI governance sprint

A focused four to six week engagement to stand up the foundations of your AI governance program. Within the sprint we map your AI footprint, run a risk assessment on the highest-stakes use cases, draft an AI usage policy your workforce will actually follow, build a vendor review process, and run a workshop with your leadership team so the program survives the handover. Best for organisations that have decided to move on AI governance this quarter, not next year.

Incident response retainer

A pre-agreed arrangement so we are ready when something goes wrong. You get a named contact, a guaranteed response SLA, pre-negotiated rates for active response work, and the peace of mind that comes with knowing your first phone call in a crisis does not start with “who do we call?”. Best for organisations that have recognised they cannot afford to assemble response capability on the bad day itself.

How we price

Honest answer: we price every engagement based on scope, stakes, and the seniority required. We do not publish a rate card, because the honest number for a three-person startup preparing for SOC 2 is not the honest number for a thousand-person regulated business preparing for ISO 27001 and APRA CPS 234 at the same time. A one-size rate card would either overcharge one client or undercharge the other, and we are not interested in either outcome.

Here is what you will always get from us.

• A fixed price for fixed-scope projects. Once we have agreed the scope, the number does not move. No surprise invoices, no line items you did not expect.
• Transparent effort assumptions. We tell you how many days of senior time we are planning, what is included, what is out of scope, and what would trigger a scope change.
• One number, not a ladder of line items. We do not bill separately for meetings, travel, document revisions, or internal review within the agreed scope.
• Senior delivery, not junior pass-through. The practitioner you meet on the first call is the practitioner doing the work. We do not mark up junior hours at senior rates.
• A clear exit. Retainers run month-to-month after any initial commitment period. If the fit is not right, you are not trapped.

What influences the price of your engagement:

• The size and complexity of your organisation, and the number of locations, products, or entities in scope.
• The frameworks, standards, and regulators that apply to you.
• How much foundational work already exists versus how much needs to be built from scratch.
• The urgency and the timeline. A six-week sprint and a six-month engagement covering the same ground rarely cost the same.
• The level of executive and board-facing involvement expected.
• Whether the engagement is a one-off piece of work or the start of an ongoing relationship.

What to expect from your first conversation

A short call, usually thirty minutes, with Tarun Jain or a senior member of the team. You tell us what you are dealing with. We ask a few sharp questions, tell you honestly whether we think we can help, and if so, sketch out which engagement model fits and what the rough shape of a proposal would look like. If we are not the right fit, we will tell you that too, and usually point you to someone who is.

There is no sales sequence afterwards. We will either send you a scoped proposal within a few working days, or we will not, and either way you will know exactly where you stand when the call ends.

Ready to talk?

Whether you already know which engagement model fits or you are still figuring out the right shape of the work, a short conversation is the fastest way to find out. Schedule an intro meeting with Tarun Jain and bring the questions you have. Thirty minutes, no obligation, and a genuinely clearer view of the next step regardless of whether we end up working together.