Plans

Sized to your company, not to a checklist.

Pentest and SOC are both dimensioned for three company sizes: what is included, how fast we respond and how deep the compliance package goes. Quotes are scoped to your surfaces and number of devices after a 30-minute call.

Company size

Small

1–50 employees

Pentest as a Service

Standard report: executive + technical
1 retest included
Email support, business hours

SOC as a Service

Up to 25 devices and 2 cloud services
Analysts Mon–Fri 8:00–18:00, on-call for critical incidents
Known threats contained automatically, 24/7
Critical response within 1 hour
Monthly executive report
Detection tested by our offensive team once a year

Get a scoped quote

Mid-size

50–250 employees

Pentest as a Service

Dedicated senior tester
SOC 2-ready compliance documentation
2 retests included
48-hour response SLA
Quarterly executive summary

SOC as a Service

Up to 100 devices and 5 cloud services
Analysts Mon–Sat 7:00–22:00, on-call 24/7
Critical response within 30 minutes
Quarterly threat hunting
ISO 27001 / SOC 2 / NIST CSF evidence
Detection tested twice a year, 8 h of incident response a year

Get a scoped quote

Enterprise

250+ or regulated

Pentest as a Service

OSCP / CISSP certified team
Full compliance package: PCI DSS, ISO 27001 and regulator mapping, audit-ready format
Unlimited retesting within the window
Dedicated Slack / Teams channel
24-hour response SLA
Board-level executive report and presentation

SOC as a Service

250+ devices, cloud sources as needed
Analyst on shift 24/7/365
Critical response within 15 minutes
Monthly threat hunting and lead analyst
Regulator mapping (SUGEF, PCI DSS) and board presentation
Quarterly purple team, 40 h of incident response a year

Get a scoped quote

Included in every pentest plan

Rules of Engagement and NDA
AI-driven testing with senior validation
Proof of exploitation on every finding
Executive and technical report
Re-test after the fix
Live walkthrough

Included in every SOC plan

Agent on every computer and server
Microsoft 365 or Google Workspace connected
AI-assisted triage with an analyst who decides
Reversible containment with a log
Four-week onboarding with your baseline
Data-processing agreement

Pentest as a Service

One-time or continuous

One-time

One full engagement on the chosen surfaces
Findings delivered in days, not weeks
Retest of critical findings per your plan

Continuous

Recon and targeted tests re-run every month
Regression checks after each release
Evidence kept current for auditors and customers
New critical CVEs checked against your assets
Support-hour pool for remediation guidance
Cancel any time after the first 3 months

Pentest types	Cadence
Web applicationsPortals, online banking, e-commerce and internal apps.	One-time or continuous
APIsREST, GraphQL and partner integrations.	One-time or continuous
Mobile applicationsAndroid, iOS and HarmonyOS, with their backend APIs.	One-time or continuous
Aerospace infrastructureGround segments, data links and mission systems.	One-time or continuous
External networkEverything reachable from the internet.	One-time or continuous
Internal networkWhat happens once someone is already inside.	One-time or continuous
Identity and Active DirectoryDirectory, credentials and privilege escalation.	One-time or continuous
Cloud and KubernetesAWS, Azure, GCP and container platforms.	One-time or continuous
WirelessCorporate and guest networks at every site.	One-time or continuous
IoT and OTDevices, industrial control and field equipment.	One-time or continuous
Social engineeringPhishing, vishing and pretexting with real impact.	One-time or continuous
AI systems and LLMsChatbots, assistants and models wired into your systems.	One-time or continuous

Multiple surfaces

Most programs combine three or more surfaces, typically external + internal + API, or web + API + mobile. Coverage is scoped on the call.

Get a scoped quote

SOC as a Service

Sized to your company.

Same technology in every package; human hours, response time and compliance depth change by size.

	Small1–50 employees	Mid-size50–250 employees	Enterprise250+ or regulated
Devices and cloud services	Up to 25 devices, 2 cloud services	Up to 100 devices, 5 cloud services	250+ devices, cloud sources as needed
Human monitoring	Mon–Fri 8:00–18:00, on-call for critical incidents	Mon–Sat 7:00–22:00, on-call 24/7	24/7/365, analyst on shift
Automatic containment	24/7 for known threats	24/7, plus manual containment by the analyst	24/7, with playbooks agreed with you
Response time, critical	1 hour	30 minutes	15 minutes
Log retention	90 days	180 days	180 days, extended archive on request
Threat hunting	Monthly inventory and vulnerability review	Quarterly	Monthly

See SOC as a Service

Corporate training

Programs scoped by team size and audience. Technical tracks delivered as a cohort for your team.

Security awareness programEveryone in the company
Technical team tracksIT and security teams
Secure developmentDevelopment teams
Leadership and incident decisionsManagement and board
Offensive AI Fundamentals8 weeks, 2 hrs/week
Defensive AI Fundamentals8 weeks, 2 hrs/week
Offensive + Defensive Advanced12 weeks, 3 hrs/week

Consulting and AI

Maturity & attack-surface assessment

SmallUp to 3 systems, 1 interview round, CMMI checklist10 business days
Mid-sizeUp to 10 systems, SOC 2 / ISO 27001 gap analysis, 3 rounds15 business days
EnterpriseUnlimited scope, SUGEF / PCI-DSS mapping, board presentation, 18–24 month roadmap25 business days

Targeted AI automation

Small1–2 use cases: AI alerting, automated scanning
Mid-size3–5 use cases: threat hunting, behavioral IAM, anomalies
EnterpriseAI SOC-lite, compliance automation, SIEM integration

Quotes in USD, scoped to your surfaces. Local taxes apply where required.