The questions worth asking first.

I find security weaknesses, investigate cyberattacks, research people or companies for business decisions, handle authorized ransom negotiations, and review AI data risks.

We define one question, the permitted work, the evidence needed, and the deliverable before I start. An Advisory Hour costs $500/hour.

I use public records, open sources, and interviews or conversations with willing people. I agree the purpose and limits with you before starting.

Human-source work means obtaining information through lawful conversations, not covert authority. I do not use prohibited pretexting, unauthorized access, or covert methods. We confirm applicable privacy, licensing, consent, and permitted-use requirements with counsel where needed; I decline a scope I cannot lawfully perform.

I return or destroy it on the schedule we agree in writing.

The agreement names any required retained records, legal holds, authorized recipients, and backup expiry. I confirm completion of the agreed return or deletion; I do not promise immediate deletion where a legal duty or evidence hold prevents it.

You own the work product created for your engagement.

The contract separates that work from pre-existing tools and third-party rights and gives you the rights needed to use the deliverable. We settle ownership terms before work starts.

Request written confirmation of applicable coverage and limits before signing.

We agree your professional liability and cyber errors and omissions insurance requirements before I accept the work. This website does not establish that a particular policy or limit applies to your matter.

The person you meet does the work and answers for the conclusion. You do not need to repeat the brief to a new team.

This fits work that needs one accountable specialist. A matter that needs parallel teams, continuous coverage, or skills outside my scope may need a larger firm. I identify that before accepting it.

My main focus is healthcare and medical technology companies with $50M–$500M in annual revenue. I also accept defined work from investors, law firms, family offices, and smaller organizations when the scope fits.

That describes my target clients, not a claim about past customers. The decision, access needs, complexity, and available capacity determine fit.

Request same-day help for an active incident. I confirm availability before accepting the matter; a message alone does not reserve a response.

For planned work, tell me if you need to start within days and I will confirm a date with the proposal. If you need immediate coverage, contact your insurer's or counsel's response team while you wait for my confirmation.

The written scope controls the fee. I do not add a charge without your written approval.

Incident Response, First 30 Days costs $25,000 flat (+$500/hour beyond 50 hours). The first 30 days include 50 hours; work beyond those hours needs approval, and work after day 30 needs a new written scope. Other fixed-price work uses a signed change if you add scope; a retainer uses the monthly capacity and schedule you approve.

Yes. I coordinate with the people already responsible for your systems, legal advice, and coverage.

We name decision-makers and evidence-sharing rules at the start. Counsel directs legal strategy and any privilege arrangements; hiring me or signing an NDA does not itself establish privilege or insurance coverage.

I perform the work myself.

I do not sell a solo engagement and hand it to junior staff. If the matter needs another provider, I explain that and agree any separate support before the work proceeds.

One hour lets us test the fit and work through a decision before you commit to a larger engagement.

It includes the call and a short next-step email, not technical testing or a separate report. It is an option, not a required delay before incident response or a proposal request.

Yes. All menu services are included within the monthly capacity and schedule we agree in writing.

The retainer costs $20,000/month. Before you sign, we record hours, priorities, concurrent projects, response windows, and escalation arrangements. It does not buy unlimited projects or continuous staffing; third-party expenses need written approval.

We record the opening demand and compare it with the final agreed demand. You choose the flat fee or percentage method before work starts.

The price is $25,000 flat OR 2% of documented savings, whichever the client prefers. The signed scope sets currency conversion, the documented baseline, a zero floor, and a dollar fee cap. No final agreed demand means no percentage fee; choosing not to pay does not create savings for this calculation. Ransom and third-party charges remain separate.

I can review security, data access, and privacy risks in the agreed AI system. Your clinical and legal advisers remain responsible for clinical and regulatory decisions.

We agree the intended use, data classes, systems, and permissions first. A security review does not establish clinical safety, HIPAA compliance, or FDA clearance. We arrange any required business associate agreement before I access protected patient information.