ISO 27001 · vCISO · Penetration testing · AI security — UK registered
Every other consultancy makes you sit through a discovery call before they will tell you a number. Here are ours. ISO 27001 consulting at £1,500. Certification at £2,500 for the full three-year cycle. A penetration test at £1,100. An AI agent built and shipped for £1,000. Nine services, nine prices, all of them below. Pick what you need, email Sandeep, and we start this week.
What it costs
Get certified
£1,500
Fixed feeEverything an auditor asks for, assembled before they ask. We write the management system around how your business already works rather than handing you a template to fill in yourself.
Get the certificate
£2,500
Three-year cycleThe audits themselves, through our partner certification body, covering the whole three-year cycle in a single price. No annual invoice you did not see coming.
Stay secure
£950
Per month, fromA named security leader on your side without a six-figure hire. Board reporting, customer questionnaires, supplier reviews, and someone accountable when an incident starts at 4pm on a Friday.
Prove it
£1,100
Per testTested by hand, not just scanned. You get a report your customers will actually accept, findings ranked by what a real attacker would do first, and a free retest once you have fixed them.
Consulting and certification together, from first gap analysis to the certificate in your hand and both surveillance audits covered. This is what most of our startup clients buy, and it is £250 less than booking the two separately.
Read the full terms →
All prices exclude VAT and are fixed in writing before any work begins. Certification is issued by the certification body, not by us — we prepare you, book it, and sit beside you on audit day. Ask us which accreditation our partner body holds before you buy, and ask every other firm the same question.
The AI practice
Build it
£1,000
Build fee, per agentA working agent in production, not a demo that impresses once and is never used again. We scope one job it has to do, build it against your real systems, and hand over everything — code, prompts, evaluations and documentation.
Secure it
£1,300
Per AI featureA security assessment of an AI feature you have shipped, or are about to. Prompt injection, data leakage, tool abuse and the supply chain behind the model — tested against the OWASP Top 10 for LLM Applications, by hand.
Govern it
£2,400
Fixed feeThe answer to the question your board, your insurer and your largest customer are all about to ask: what is this company doing with AI, who decided, and who is accountable when it goes wrong.
What an AI agent actually costs to run
Build fee
£1,000
One-off, fixed, paid to us. Covers scoping, build, guardrails, evaluation and handover of a single agent.
Model & token usage
Indicatively £30–£250/mo
Paid directly to your provider — OpenAI, Anthropic, Azure OpenAI or Bedrock — on your own account. A small internal agent sits at the bottom of that range; a customer-facing one with heavy traffic sits above it.
Cloud hosting
Indicatively £20–£120/mo
Your own AWS, Azure or GCP account. A single containerised agent with a queue, a database and logging sits in that band. Serverless can be less.
Support & monitoring
From £350/mo optional
Model and prompt updates, evaluation re-runs when behaviour drifts, cost and failure alerting, and a quarterly security review of the agent. Ask about support.
We deliberately put the model keys and the hosting on your accounts rather than reselling them through us. You own the agent, you see the real bill, you can take it to another supplier tomorrow, and we take no markup on tokens or infrastructure. If an agent turns out to be expensive to run, you will find out from your own invoice and not from ours.
Programme delivery · Priced by scope
Programme and project management is sold by the shape of the engagement, not by the deliverable — so instead of one number we publish the rate card and let you pick the intensity. Everything else on this site is a fixed fee. These two are the honest exception, and we will still put the monthly figure in writing before we start.
Run the AI programme
£4,500
Per month, fromMost agentic AI programmes do not fail on the model. They fail on nobody owning the sequence: which process goes first, who signs off autonomy, what happens when an agent is wrong, and how it all gets into production without the risk committee stopping it.
Run the data programme
£5,500
Per month, fromPlatform migrations, warehouse rebuilds and governance programmes that have stalled between the business case and the cutover. We take the plan, the vendors and the steering committee off your plate and drive it to a date.
The rate card
One day rate of £550 underpins all of it, and the more days you commit to, the lower the effective rate. Delivery is remote by default; UK on-site attendance is charged at cost and agreed in advance.
| Engagement shape | Days per week | Monthly, from | Effective day rate |
|---|---|---|---|
| Advisory | 1 day | £2,200 | £508 |
| Standard | 2 days | £4,500 | £519 |
| Intensive | 3 days | £6,600 | £508 |
| Full-time | 5 days | £10,500 | £484 |
Ex VAT. Figures assume a 4.33-week month. Short engagements under one month are quoted at the £550 day rate. A fixed-price statement of work is available once scope is agreed, which most clients prefer after the first month.
Selected work
We will not put a customer's logo on a website in exchange for a discount, and we will not name one without written permission. What we can tell you is the sector, the service and what was actually delivered. On a call we can go deeper, under NDA, and in several cases a reference call can be arranged with the client's agreement.
Payments & fintech
United KingdomISO 27001 built from a blank page against a bank partnership deadline. Scope covered the payments platform, the support function and two AWS accounts, with the certificate in hand before the partner's cut-off.
ISO 27001
Healthcare technology
UK — NHS supply chainManual testing of a patient-facing portal and its clinician admin surface, plus the evidence pack for the Data Security and Protection Toolkit. All high findings remediated and retested inside the free 30-day window.
Penetration testing
B2B SaaS — HR technology
UK & EURetained security leadership. We answer every inbound customer security questionnaire, run the quarterly supplier review cycle, and present the board and investor security pack.
Fractional vCISO
AI product company
United KingdomSecurity assessment of a customer-facing agent with tool access to account records. Indirect prompt injection and tool-abuse findings were closed before public launch, and ISO/IEC 42001 groundwork followed.
LLM security
Logistics & supply chain
United KingdomAn internal agent that triages and routes carrier exception emails into the operations queue. Built and shipped in four weeks, running on the client's own cloud account at a low double-digit monthly cost.
AI agent build
How we deliver
Your engagement lead, your vCISO and every client-facing conversation sit in the UK. Your contract is with a company registered in England and Wales, governed by English law, with a UK bank account and a UK VAT number.
Our analysts, testers, AI engineers and documentation team work from India. They are the honest reason a £1,500 ISO 27001 engagement is viable in a market that routinely charges ten times that for the same deliverables.
Work lands overnight. Send evidence at 5pm, review finished control documentation at 9am. Over a twelve-week certification programme that difference compounds into weeks, not days.
Where your data sits. UK or EU hosting by default. Anything our India team touches is covered by an International Data Transfer Agreement with the UK Addendum, against named, background-checked personnel under NDA. We will show you the transfer paperwork and our own supplier assessment before you sign anything — which is exactly what we would tell you to demand of any supplier. [Confirm your hosting region, screening standard and DPA template here.]
The Nine Points
01
What is in, what is out, and a boundary you can defend to an auditor in one sentence.
02
What is connected, what is exposed to the internet, and what has quietly fallen out of support.
03
A register that reflects your actual business, not a copied spreadsheet of generic threats.
04
MFA wherever it is offered, least privilege by default, joiners-movers-leavers that runs without chasing.
05
Who you depend on — including which models and which providers — what they can reach, and the evidence you reviewed them.
06
A tested plan that meets a 24-hour notification clock, not a document nobody has opened.
07
A Statement of Applicability an auditor can follow alone, without a guided tour from your head of engineering.
08
Controls that produce their own proof as they run, so the surveillance audit stops being a fire drill.
09
Board-level review with metrics that mean something, risk decisions recorded, improvement you can point to.
Startups first, enterprise next
Stage one · Seed to Series A
A 200-question security questionnaire has landed, the deal is worth more than your last raise, and nobody on the team has done this before. You need a certificate, and you need it before the contract date.
Start withThe certification-ready bundle at £3,750, or consulting alone at £1,500.
Stage two · Series B and scale-up
Compliance has become a part-time job for someone hired to do something else, customers now want annual penetration tests, and the AI feature you launched last quarter has never been security tested once.
AddFractional vCISO from £950/mo, testing at £1,100, LLM security at £1,300.
Stage three · Enterprise
You are now the supplier being assessed, and your own vendors need assessing. The questions are about resilience, AI governance and board accountability, not just controls.
AddAI governance at £2,400, ISO/IEC 42001, and programme management from £4,500/mo to hold it together. Talk to us.
Who does the work
Founder & Principal
Twenty-plus years in security and compliance. Your first email, your scoping call and your engagement lead throughout — he owns the fee, the timeline and the outcome, and he is the person who answers when something goes wrong.
UK citizen · United KingdomManagement systems
Policy set, risk register and Statement of Applicability, plus the internal audit that happens before the certification body ever sees you.
ISO/IEC 27001 Lead Implementer · Lead Auditor · ISO/IEC 42001 Lead AuditorOffensive security
Manual testing against web applications and external infrastructure, reported in a format procurement teams and auditors both accept.
OSCP · CREST Registered Tester · Burp Suite Certified PractitionerAI engineering
Design, build and evaluation of production agents against your real systems, with guardrails and audit logging in from the first commit.
AWS Certified ML Specialty · Azure AI Engineer AssociateAI security
Prompt injection, tool abuse, data leakage and model supply chain — tested by hand against the published threat taxonomies, not by a scanner.
OWASP Top 10 for LLM Applications · MITRE ATLAS · ISO/IEC 42001Assurance
Evidence collection, control mapping and the documentation that makes an audit short. The overnight shift that keeps your programme moving.
ISO/IEC 27001 Internal Auditor · CompTIA Security+ · Cloud securityEveryone above is on our own team, under our own NDAs and our own supervision — nothing is passed to a third-party firm you have never met. If you want to meet the people on your engagement before you sign, we will put them on the call. That is a reasonable thing to ask of a security supplier, and we would ask it too.
Straight answers
There isn't one, but there is a reason. The UK market charges £15,000 and upwards because the work is done by UK consultants at UK day rates, and most of that work is document production rather than judgement. We keep the judgement in the UK and do the production in India. You get the same deliverables, prepared by people who do nothing else all week, at a price that reflects where the hours are spent.
What you do not get for £1,500 is us engineering your infrastructure, writing your product code, or operating your security tooling. That is a separate conversation with a separate price.
The £1,000 is a one-off build fee for one agent doing one job: scoping, integration, prompt and guardrail design, an evaluation harness, human-in-the-loop controls, audit logging, and a full handover of the code and prompts. It is not a per-seat licence and there is nothing to renew.
Running it costs you two things, both on your own accounts and neither with any markup from us: model and token usage, indicatively £30 to £250 a month depending on traffic, and cloud hosting, indicatively £20 to £120 a month for a single containerised agent. Ongoing support and monitoring is optional, from £350 a month. We will estimate your specific numbers during scoping, before you commit.
Because the failure modes are new and your existing penetration test did not look for them. An agent with tool access can be talked into doing things no form field ever could — reading another customer's records, calling an internal API, leaking the contents of its own context window, or spending your entire monthly token budget on behalf of an attacker.
Our LLM assessment tests direct and indirect prompt injection, tool and function-calling abuse, retrieval and context data leakage, insecure output handling, and guardrail and rate-limit bypass, against the OWASP Top 10 for LLM Applications. You get severity-rated findings, fixes, and a free retest within 30 days. £1,300 per feature.
Certification is issued by a certification body, never by a consultancy — if any firm tells you otherwise, walk away. We prepare you, book the audits and attend them with you. [State here which body you partner with and which accreditation it holds — UKAS or another IAF signatory.]
Ask us, and ask every competitor, the same question: accredited or not? A non-accredited certificate is cheaper and quicker, and some enterprise buyers will reject it. You should know which one you are buying before you pay for it.
Run it. On a programme engagement we own the plan, chair the steering committee, hold the vendors to their contracts, keep the RAID log honest and report to your executive in their language. You get a named programme manager, not a deck of recommendations and an invoice.
That is why those two services are priced by the shape of the engagement rather than by deliverable — one day a week to keep a programme on the rails costs less than three days a week to rescue one. The rate card is published above, the day rate is £550, and we will put the monthly figure in writing before we start.
Evidence is held in UK or EU hosting by default. Where our India team needs access, it is covered by an International Data Transfer Agreement with the UK Addendum, limited to named individuals who are background-checked and under NDA, with access removed at the end of the engagement. For AI work, model keys and hosting stay on your own accounts throughout.
We will send you the transfer paperwork, our access control list and our own supplier assessment before you sign. You are buying security services — you are entitled to assess us exactly as hard as your customers assess you.
Remediation engineering work on your systems, software or tooling licences, and the certification body's own travel if they insist on an on-site audit outside London. For AI agents: model usage, cloud hosting and any third-party API your agent calls. Penetration and LLM retests are free once, within 30 days; after that they are quoted separately. Anything that would change the fee is agreed in writing before we do it.
We can usually begin within a week of your email. A penetration test or LLM assessment is scheduled within ten working days and reported within five working days of testing. An AI agent takes three to five weeks from scoping to production. ISO 27001 runs six to ten weeks to audit-ready, then four to eight weeks for the certification body's Stage 1 and Stage 2 — book the body early, because the good ones have waiting lists.
No. Consulting, certification, penetration testing, LLM assessments and agent builds are one-off fixed fees. The vCISO and AI support are the only recurring services, both have short minimum terms, and you can leave on 30 days' notice. We would rather you stayed because the work is good than because the contract made it difficult to leave.
Terms and conditions
01
All prices on this page exclude VAT, which is charged at the prevailing UK rate where applicable. Published prices are indicative of standard scope and are confirmed in a written quotation, valid for 30 days.
02
Every engagement begins with a written statement of work setting out deliverables, timeline and fee. Anything outside it is quoted and agreed in advance. We do not invoice for work you have not approved in writing.
03
Fixed-fee work: 50% on signature, 50% on delivery. Retainers are invoiced monthly in advance. Payment is due 14 days from invoice date. Late payment may attract statutory interest under the Late Payment of Commercial Debts (Interest) Act 1998.
04
The certification fee covers the Stage 1, Stage 2 and two surveillance audits described, through our partner certification body, for one three-year cycle at the agreed scope. Re-audits following a failed Stage 2, scope increases, added sites or transfers from another body are quoted separately.
05
The build fee covers one agent at the scope agreed. Model and token usage, cloud hosting and any third-party APIs are contracted and paid by the client on the client's own accounts. We apply no markup and accept no liability for provider price changes, model deprecation or service availability.
06
Penetration and LLM testing requires written authorisation from the owner of the systems in scope; we will not test assets you do not control. One retest of remediated findings is included free within 30 days of the report. Later retests are quoted separately.
07
Fixed-fee engagements may be cancelled before work begins for a full refund, less any third-party fees already committed. Testing may be rescheduled free of charge with five working days' notice; later than that, 50% of the fee applies. Retainers may be ended on 30 days' written notice.
08
On payment in full you own all deliverables produced for you — documentation, policies, reports, source code and prompts. We retain ownership of our own templates, methodologies, tooling and general know-how.
09
A mutual NDA is available before scoping and we will sign yours. Personal data is processed under a written data processing agreement; transfers to our India team are covered by an International Data Transfer Agreement with the UK Addendum. Evidence and client material are returned or deleted within 90 days of completion on request.
10
Services are performed with reasonable skill and care by suitably qualified personnel. No security assessment can guarantee that a system is free of vulnerabilities, and no consultancy can guarantee a certification outcome, which rests with the independent certification body. Our liability is capped at the fees paid for the relevant engagement. Nothing excludes liability for death or personal injury caused by negligence, or for fraud.
11
Work is delivered by our own UK and India personnel under our own confidentiality and screening arrangements. We do not subcontract to third-party firms without your prior written consent.
12
These terms and any engagement are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
13
Programme and project management is charged monthly in advance against an agreed number of days per week, at the published rate card. Unused days do not roll forward. Delivery is remote by default; UK on-site attendance and travel are charged at cost and agreed in advance. Minimum term three months, then 30 days' written notice.
This summary sets out the standard terms on which we trade. It is not itself the contract — the binding terms are those in your signed statement of work, which we will send before any work begins and which prevail in the event of any conflict. [Have these reviewed by your solicitor before launch, and add a registered address, complaints route and insurance details.]
One email, one price, one answer
Or pick a service and we will pre-fill the email