Tell us what you need secured.

The external security assessment has one fixed published price. Penetration tests and adversary emulation are quoted against the agreed scope, and the cybersecurity services page shows the market reference range for each. The scope, price and permissions are agreed in writing before any testing starts.

On résumé, they are ahead, and you should discount anyone who tells you otherwise. There are onshore firms in this space that have been doing it for eighteen, thirty, even fifty years, with senior engineers and named clients in your industry. The difference we would ask you to weigh is structural rather than technical. Most firms our competitors’ size specialize in one layer and subcontract or decline the rest, so the seams between the control network, the application, the estate and the security review end up owned by whoever is left in the room. We run those as four divisions inside one company, under one contract, which is why the escalation path ends somewhere useful instead of at a vendor boundary. That is the trade on offer: longer history and more logos on one side, and on the other a smaller senior team that can follow the problem across every layer it touches.

Yes. Your engineers contribute business knowledge and review the work with ours. Shared development and documentation also prepare your team for handover.

Before testing starts nothing is committed: delivery begins only after the scope, price and permissions are agreed. Once agreed, the engagement ends at its scope, with the report and debrief. Retesting, training or remediation support after that is a separate decision, with no obligation to buy it.

Yes. We work under client paper rather than asking you to work under ours, and we redline rather than refuse. Security is handled through an exhibit written for your data rather than a pointer to our own policy, and the terms we will agree to there include notification of any actual or suspected incident within 24 hours, the content and timing of any notification to your customers or regulators left entirely in your control, a BAA where PHI is involved, and support for joint security testing. Questionnaires are part of onboarding rather than an afterthought. Send the requirements early, including whatever insurance you require us to carry, and we’ll flag anything we can’t meet.

Usually one of three ways, and we will tell you which is fastest for your institution rather than the one that suits us. First, subcontracting: we work under a prime who already holds the vehicle, which is the most common route for a firm at our stage and needs nothing new from your procurement office. Second, your own delegated authority: many institutions can issue a purchase order directly for services under their own limit, and those limits are set locally rather than centrally, so the number is yours to confirm. Third, a cooperative or state vehicle you already use. Being plain about that third one: we hold no cooperative or state contract awards today. Awards on those come through competitive solicitation cycles rather than on request, they are published, and any vendor implying otherwise is worth checking. If a vehicle is the only viable path for you, the honest answer is that we are the wrong firm this fiscal year, and we will say so on the first call rather than in month two.