Published prices.
No discovery call required.
This market quotes by request. That's not how it works here. Below are the numbers, the scope caps, the response windows, and the things that aren't for sale at any price — all before you talk to anybody.
2 retainers
Two clients at a time, one onboarding per quarter. Not a marketing device — it is the hour budget with the overhead counted. Ask what's open.
Read the work before you buy any of it.
Nothing on this screen needs an email address, a call, or a signature.
FOXCHECK
One command tells you what's actually exposed on a box. Runs on your machine, reports to you, phones nobody.
Any box you own
BASELINE
The whole self-hosted stack, complete and safe on one box. Monitoring, detection, identity, perimeter. Clone it and go.
1 host, 1 tenant
SIGNAL
What broke this week, what it means for a stack like yours, and what to actually do about it. No fear-mongering, no vendor press releases.
Email, weekly
FOXHOLE
The fleet version, forked into your own org. Multi-node, multi-tenant, and maintained — for people running this for more than themselves.
1 org · unlimited seats · 60 hosts
SILENT UPGRADE
Your stack stops rotting. One tested patch train a month, and you only hear about the advisories that are actually yours.
25 hosts · +$28/host
Start with a fixed fee, not a commitment.
Problems arrive as events, not subscriptions. Both of these are flat-fee, both credit toward a retainer if you want one after, and neither requires you to decide anything today.
TAKEOVER SPRINT
Two weeks on one environment you inherited. At the end you know what's in there, it's patched, it's watched, and it's written down.
The fastest way in. No monthly commitment, and it credits toward one
1 environment · 2 weeks · flat fee
- Full sweep and a written map of the environment
- Every critical gap closed, or documented with the reason it wasn't
- Detection deployed and tuned to something you'd actually read
- A handoff document your own people can work from
- A fixed fee agreed before it starts, and never adjusted after
RECON
The full estate mapped, not just one box. Every retainer starts here or with a sprint — the alternative is guessing at your network and charging you for the guess.
Bigger than one environment. A sprint maps a single box; this maps the whole estate and comes back with a plan and a deployment shape. Nobody gets a monthly commitment without one of these two first, because the alternative is guessing at your network and charging you for the guess.
Up to 40 hosts across 3 environments
Book a call about RECON- Full sweep of the infrastructure and configs, documented
- A written architecture map with a diagram, in your repo
- Every gap ranked by what would actually hurt, with hours attached
- The stuff you inherited and nobody understands — explained
- A deployment plan: your metal, your cloud, or a mix
- A 30-day channel afterward for the questions the report creates
Four ways to work together.
Whoever you meet on the call is who does the work, at every tier. The difference is how much of your infrastructure we touch — and one of these tiers touches none of it.
OUTPOST
One environment, run properly. The stack deployed, watched, patched, and documented — so the thing you inherited stops being a liability.
Scope cap3 environments · 30 hosts · +$750/environment
A handful of environments and no security person. Absorbed overhead against one avoided loss
Start with RECON- DEAD RECKONING — the living map of what's running and why
- SILENT UPGRADE — the tested monthly patch train
- Detection deployed and tuned until the alerts mean something
- Triage acknowledged within 4 business hours, 09:00–18:00 ET, Mon–Fri
- Monthly 60-minute working session, recorded if you want it
- 4 directed hours a month, tracked and shared
ENCLAVE
Most take this oneEvery environment you run for someone else, on one invoice. Patched on the same train, watched by the same rules, documented to the same standard.
Scope cap6 environments · 60 hosts · +$700/environment
An agency holding other people's infrastructure. $750 per environment — resells at a normal care-plan markup
Start with RECON- Everything in OUTPOST, across up to 6 client environments
- NIGHTWATCH — detection across the fleet, so you hear it before your client does
- One patch train covering every environment, not five separate scrambles
- Findings written so you can forward them to a client unedited
- Answers for the security questions your clients ask you
- 8 directed hours a month · bi-weekly working session
STRONGHOLD
Everything in ENCLAVE, plus the build pipeline and the weird stuff — air-gapped segments, plant networks, and the environments nobody else will touch.
Scope cap12 environments · 120 hosts · +$650/environment
A real fleet, or environments that get strange
Start with RECON- Everything in ENCLAVE at double the environment and host cap
- Signed builds, SBOM, secrets scanning, and policy gates in your pipeline
- Network segmentation for air-gapped or industrial environments
- Architecture documentation your clients can be shown directly
- Framework mapping if a client demands one — capability, not identity
- 14 directed hours a month · in your channel daily
PAPER TRAIL
The full written record — architecture, controls, evidence, and the answers to whatever questionnaire is blocking your deal. Authored once, against the stack that's actually running.
Scope capAdd-on to any retainer
A deal or renewal blocked on paperwork nobody has written
Start with RECON- Architecture and control documentation across the whole estate
- Evidence mapping — the artifact for every claim, dated and hashed
- The answer library for client and insurer questionnaires
- Framework mapping on request, if a customer is demanding one
The four things money can't buy here.
Stated here rather than discovered on a call.
- Round-the-clock human coverage. Detection runs continuously; we don't. We can't honour a 3am promise, and you'd find out at the worst possible moment.
- Certification or audit sign-off. We'll help you meet a framework; we'll never be the ones attesting that you did. Nobody who implements a control gets to certify it, and that includes us.
- More than 12 environments or 120 hosts. Past that it gets referred out to someone with a bench.
- A report followed by silence. That is the thing we exist to be the opposite of.
Everything a procurement review would ask for.
Published here rather than surfaced in month three. Thirteen clauses in five groups — they arrive as you scroll.
How an engagement starts, what the first ninety days look like, and how you leave. Nothing here locks you in, because a practice with no track record hasn't earned the right to.
- Initial term
- 3 months, then month-to-month on 30 days' notice, either direction. No auto-renewal, no cancellation fee, no remaining-term acceleration. A practice with no track record does not get to demand a lock-in from the party carrying the balance sheet.
- Onboarding
- ENCLAVE $12,500 · STRONGHOLD $18,000. Half on signature, half across months 2–3. A completed RECON credits $6,500 against it. Real onboarding is roughly 90 hours, so it is priced at what it costs instead of what is comfortable.
- Onboarding cadence
- One per quarter, 90 days between start dates. A signed RECON reserves a dated slot. That caps growth at four new clients a year, and that is the honest constraint rather than a marketing one.
- First deliverable
- Baseline snapshot on day 15, first full monthly artifact on day 45. Month one is onboarding and is not sold as a delivery month.
What you pay, how you pay it, and the only circumstances under which the number moves. Every rate on this page is stamped and changelogged.
- Prepay
- Quarterly −5%. Annual is ten months for twelve, and locks the rate for the prepaid period. That rate lock is the real reason to take it.
- Payment
- ACH free. Card +3%. Net-15 at +3%. Net-30 and beyond declined — we're small enough that we can't bank a receivable, and pretending otherwise is how small shops die.
- Price changes
- Stamped Pricing v2026.08 with a public changelog. Your rate is locked for the initial term and any prepaid period. At renewal, then-current list, capped +10% per 12 months for continuously active clients, 60 days' notice.
Work that sits outside the monthly fee, priced in the open. Nothing here is ever auto-billed — it takes your written approval first, every time.
- Out of scope
- Overage $295/hr with written approval, 30-minute increments. Non-client consulting $325/hr, 4-hour minimum. Prepaid 10-hour block $2,950. Nothing is ever auto-billed and hours do not roll over.
- Incident response
- $395/hr with a $3,900 activation. We don't bundle it into any tier, because that would be selling you a promise we can't keep. Your agreement names your own off-hours escalation path for the hours we aren't awake.
What it costs us when we miss, and the hard cap that stops us overselling the hours we have. A response window with no remedy attached is just a marketing number.
- Missed response window
- 5% of the monthly fee per missed acknowledgment, 2% per missed monthly artifact, capped at 25% in a month. Measured from the shared ticket log, which you can audit. A response window with no remedy is a marketing number.
- Client cap
- We carry two retainers with a response window, and three client relationships in total. Not scarcity theatre — it's our hour budget with the overhead counted honestly.
What is yours during the engagement and what stays yours after it. Leaving is supposed to be easy — that is the entire point of owning your own stack.
- White label
- We write findings and documentation so you can hand them to your client unedited, under your own name. Crediting us is optional and never required. What isn't negotiable is that nothing about your clients gets published without written consent.
- If we stop
- You keep every config, runbook, and document in your own repo under a perpetual license for what was deployed. No exit fee, no data hostage, no proprietary agent to rip out. Leaving is supposed to be easy — that is the whole point of owning your stack.
Not ready for a call? Start with the repo.
Apache-2.0, complete for one host, and the audit tool runs on your machine and reports to you. Nothing is sent anywhere. If it tells you something useful, you know where to find us.
All prices are per organization and do not change when you add machines. Every price on this page is stamped Pricing v2026.08.