The services arm of CISO Marketplace
Offensive security.
AI security.
Done by operators.
We break into networks, applications and AI systems the way real adversaries do, then show you exactly how to close the path. Fixed scope, published starting prices, evidence behind every finding.
Not sure what you need? Start here — six questions, about ninety seconds.
- Anthropic Claude Partner· Official partner
- OpenAI TAC· Verified firm
- 400+ technology suppliers· Risk-to-solution sourcing
- Cloudflare Startup Partner
Flagship practices
Two disciplines, one team.
Most real breaches now chain a traditional weakness with an AI one. We test both, together.
Practice 01 · Offense
Offensive Security
Penetration testing, red teaming and adversary emulation run by operators, not scanners. We prove what an attacker can reach, show you how, and help you verify the fix.
- Penetration testing
- Red team & adversary emulation
- Social engineering & physical
- Continuous exposure
- Specialized targets
27 services
Practice 02 · AI
AI Security
Red teaming for LLM applications and agents, security for the pipelines behind them, and governance your auditors and board will accept. Delivered by an Anthropic Claude Partner and OpenAI TAC-verified firm.
- Attack your AI
- Govern your AI
- Run security with AI
13 services
Not sure where to start?
Start with Phase 0.
The six pillars of the AI security program are not sold off a shelf — they are built into your ecosystem, and that requires knowing the ecosystem first. Phase 0 is a scoped, fixed-fee assessment that maps your environment end to end: every AI system in use (sanctioned and shadow), the DevSecOps reality, the data and identity stack, the SIEM / EDR / tooling landscape, and where testing should start. It defines how each pillar gets built for you (BYOK and open-source first, commercial upgrades where they earn their place), designs the integration seams into what you already run, and plans the deployment topology for distributed sites. The output is the current-state map, the future-state design and a sequenced build plan — and only then does the program get a number. CISO Marketplace members get the Phase 0 fee credited toward the program if they proceed.
From$17.5K
See Phase 0 →The full practice
182 services across the security program.
When testing finds the gaps, the same team can close them: cloud, incident response, leadership and compliance.
20 services
Cloud & Application Security
Cloud posture, application and API security, secure code review and DevSecOps. Security built into how you ship, not bolted on afterwards.
16 services
Managed Security & Incident Response
Incident response readiness, retainers, threat hunting, forensics and tabletop exercises, so the first time you run your plan is not during an incident.
21 services
Advisory / vCISO
Fractional security leadership, program development and board-level risk communication from practitioners who have held the role.
43 services
Compliance & GRC
SOC 2, ISO 27001, HIPAA, PCI DSS, CMMC, FedRAMP and privacy programs, scoped to the audit you actually face.
60 services
Specialized & Industry
Sector-specific assessments and OSINT, from energy and maritime to executive protection and M&A due diligence.
Everything
Browse the full catalog
Process
How every engagement runs.
Same six steps whether it's a single web application or a multi-site red team.
- 01
Scoping call
A practitioner, not a salesperson, walks through targets, constraints and what a good outcome looks like for you.
- 02
Proposal & rules of engagement
A fixed-scope proposal with tier, price and deliverables. Rules of engagement, contacts and out-of-bounds systems are agreed in writing.
- 03
Sign, then start
MSA and SOW are signed electronically and the deposit is paid. Only then does testing begin.
- 04
Execution
Testing runs to the agreed plan. Critical findings are escalated as they are found; you don't wait for the report.
- 05
Report & debrief
An executive summary plus technical findings with evidence, reproduction steps and fixes, walked through with your team.
- 06
Retest
Where the tier includes it, we verify your fixes and reissue the report, so auditors and customers see the issues closed.
Timelines are set per engagement in the SOW.
Research
Latest from the blog
incident-response · Nov 13, 2026
Ransomware Crews Hit Financial Sector 3 Times in 72 Hours. What Changed
A 72-hour burst of ransomware leak-site postings against financial firms shows identity-based access, not perimeter exploits, now drives most intrusions — and regulatory clocks still assume otherwise.
operations · Nov 13, 2026
Internet Background Radiation: 4.1 Million Requests, 41,757 Addresses, and What Actually Hits a Small Security Estate in a Week
We pulled a week of edge traffic across our 67 domains: 4.16 million requests, 17% flagged as threats, 41,757 distinct addresses in 72 hours of firewall events, and one block every second. Here's who sends it (mostly cloud servers wearing browser costumes), what they hunt for (your .env file above everything), and where autonomous, AI-driven attacks are starting to show up in the numbers.
operations · Nov 12, 2026
Bots in the Inbox: 228 Fake Newsletter Signups, and What CAN-SPAM Actually Asks of a Small Sender
When we moved two dozen sites onto one newsletter system, we found 228 bot signups carrying scam lures in the name field, and two older single opt-in lists that were almost entirely bots. Here's how signup abuse works, the controls that stopped it, and a plain-language checklist of what CAN-SPAM requires, including the one item we had missed.
Start an engagement