Services & prices

Know the work. Know the fee.

Choose a defined engagement or start with one hour. I confirm scope, availability, and terms before you commit.

Advisory Hour OSINT Deep Dive Incident Response, First 30 Days Ransomware Negotiation Red Team Engagement (3 Weeks)Board Briefing / Training Day AI Security Review (Local LLM / Medical AI)Retainer (Fractional CISO / Intelligence Officer)

Advisory Hour

Spend one hour with me by phone or video to work through your problem and decide what to do next.

We focus on one decision, the facts you have, and the questions you still need to answer. This is advice, not an investigation, technical test, or written expert opinion.

$500/hour

Scope & terms

One booked hour costs $500. We agree before adding time; the hour does not include a separate engagement or report.

Discuss this engagement

What you receive

A one-hour conversation and a short email recording the agreed next steps.

OSINT Deep Dive

Before you hire, invest, or sign, I research a person or company and explain what the available evidence supports.

Open-source intelligence means research using public records and other lawful sources. I can add structured interviews, willing conversations, records analysis, and relationship mapping within the agreed scope.

$15,000 flat

Scope & terms

We name the subject, question, jurisdictions, sources, interview limits, and cutoff date in writing. Missing records remain unknowns; I do not promise to find everything or offer a regulated background check without confirming the requirements.

Discuss this engagement

What you receive

A written dossier with source citations, facts checked against other sources, competing explanations, confidence judgments, gaps, and a decision summary.

Incident Response, First 30 Days

If you have been hacked, I help contain the attack, investigate what happened, and plan the return to work.

I triage the incident, preserve evidence, investigate affected systems, and document who collected or handled each evidence item. I coordinate the work with your IT team, counsel, and insurer within the agreed authority.

$25,000 flat (+$500/hour beyond 50 hours)

Scope & terms

The first 30 calendar days begin on the start date in the agreement and include 50 hours. I track time, flag the approaching limit, and obtain written approval before billing beyond 50 hours; work after day 30 needs a new written scope. The fee does not guarantee complete recovery or include a ransom, outside vendors, or round-the-clock staffing.

Discuss this engagement

What you receive

A containment and recovery action list, incident timeline, evidence and custody record, findings with known gaps, and a closing briefing.

Ransomware Negotiation

If attackers demand money, I manage the negotiation and document the choices for you and your advisers.

I plan communications, handle authorized contact with the attackers, and coordinate any approved payment logistics with counsel, your insurer, and qualified providers. You control the decision; I do not hold or transmit client funds.

$25,000 flat OR 2% of documented savings, whichever the client prefers

Scope & terms

You choose one fee method in writing before work starts. For the percentage option, the signed scope records the documented opening demand, currency and conversion source/date, the final agreed demand, and a dollar fee cap; the fee is 2% of the difference, never below zero and never above that cap. No final agreed demand means no percentage fee. We exclude restored-data value, business losses, payment charges, and speculative future demands from savings; a decision not to pay is not itself savings. Ransom and third-party charges are separate. The percentage option gives me a financial incentive to reduce the recorded demand, which we disclose in the agreement. Counsel and approved providers assess sanctions and other payment restrictions; I make no payment or recovery guarantee.

Discuss this engagement

What you receive

A negotiation plan, authorized communication log, documented fee calculation, decision record, and insurer or counsel handoff.

Red Team Engagement (3 Weeks)

With your permission, I test how an attacker could get into your company and show you the gaps I find.

Adversary emulation means a controlled rehearsal of realistic attacks. The written rules can cover technology, social engineering, physical access, and business processes, with permissions, safety limits, and a stop contact for each test.

$50,000 flat

Scope & terms

Three weeks of testing within agreed targets and working windows. We authorize third-party systems and physical locations separately; no test can find every weakness. We agree any retest or additional targets before starting that work.

Discuss this engagement

What you receive

An attack-path record, evidence-backed findings ranked by business impact, recommended fixes, and an executive debrief.

Board Briefing / Training Day

I spend a day helping your board or leadership team understand its security risks and the decisions it needs to make.

We agree the audience, questions, and material in advance. I prepare a briefing and discussion record that you can use in board materials; any education-credit eligibility needs confirmation from the relevant body.

$10,000/day

Scope & terms

One agreed briefing or training day, with the preparation and materials listed in the scope. I quote travel and any added sessions before you approve them.

Discuss this engagement

What you receive

A briefing deck, a written decision summary, and a list of questions or actions for follow-up.

AI Security Review (Local LLM / Medical AI)

I check how your company uses AI, where patient or business data could escape, and what you can change to reduce that risk.

A large language model, or LLM, is AI that works with language. I review advanced hosted models and models on your own equipment, map data flows, examine access and storage, and identify privacy and safety risks in the agreed deployment.

$35,000 flat

Scope & terms

We name the systems, integrations, data classes, and review depth in the scope. This is a security review, not clinical validation, a legal opinion, regulatory clearance, or a certification that the system complies with HIPAA or FDA requirements.

Discuss this engagement

What you receive

A data-flow map, findings ranked by severity, evidence and limitations, a prioritized remediation plan, and a leadership readout.

Retainer (Fractional CISO / Intelligence Officer)

Keep me as your security adviser for ongoing decisions, planned work, and priority incident support.

A fractional chief information security officer is a part-time security leader. I personally provide ongoing advice, intelligence analysis, priority response, and quarterly risk reports for your board; intelligence officer describes a consulting function, not a government position.

$20,000/month

Scope & terms

All menu services are included within the monthly capacity, priorities, and schedule we agree before signing. The agreement states hours, concurrent-project limits, contact windows, incident escalation, and what happens if I am unavailable. One person cannot provide unlimited work or a continuously staffed response desk. No extra work or third-party cost creates a charge without your written approval.

Discuss this engagement

What you receive

A monthly work plan and action record, the deliverables for the included work we schedule, and a quarterly board risk report.

A place to start

One hour. One decision.

Work through your problem before committing to a larger engagement.

Book an Advisory Hour — $500 Request a proposal