Every engagement ends with controls mapped and spend ranked by risk reduced. Scope quoted after a short discovery call — the figures below are starting points.
Audit-ready posture for CMMC, RMF, and FedRAMP timelines.
Full control-by-control assessment, incl. AI overlays
from $9,500
Gap analysis + prioritized readiness roadmap
from $7,500
AI RMF profile for federal AI-enabled systems
from $6,500
800-53 controls mapped to models, data pipelines, inference
from $8,500
Readiness path for SaaS AI providers pursuing FedRAMP
from $12,000
One prioritized control plan across frameworks.
CSF 2.0 profile incl. AI overlays
from $4,500
ISMS gap + AI management system readiness
from $5,500
Implementation-group review incl. AI/ML hardening
from $3,500
Trust Services criteria, incl. AI systems
from $6,500
Misconfig, identity, and AI pipeline exposure review
from $4,000
Model-level, governance, supply chain, privacy, and incident readiness.
Poisoning, model inversion, adversarial robustness, prompt injection
from $7,500
Transparency, bias, explainability, human oversight
from $6,000
Model provenance, third-party AI, training data
from $4,500
Privacy family + AI RMF privacy assessment
from $4,500
AI-specific IR plan and facilitated exercise
from $3,500
Vendor AI usage and risk assessment
from $3,000
All assessments are fixed-fee, remote-first, and delivered with a prioritized POA&M. Composite assessments (e.g., CMMC L2 + AI overlay) are scoped individually.
Rules-of-engagement driven. Findings map to CWE/CVE and framework controls (800-53, CSF 2.0, CIS) so results feed straight into your remediation plan.
Perimeter, exposed services, and lateral movement paths
from $8,500
OWASP Top 10, auth flows, APIs, and business logic
from $6,500
Prompt injection, jailbreaks, agent-tool abuse, data exfiltration
from $7,500
IAM, storage, and container/Kubernetes attack paths
from $9,000
Pretext campaigns with click-rate and reporting-path results
from $3,500
Verify fixes, close findings, auditor-ready attestation letter
from $2,500
Every test begins with a signed scope and rules-of-engagement document. Retest pricing applies within 90 days of the original engagement.
30 minutes to scope environment, frameworks in play, and deadlines.
Interviews, evidence review, and technical testing against the selected framework.
Prioritized POA&M with risk-ranked spend — board- and auditor-ready.
VANGUARD