Skip to content

CYBERSECURITYLINKBook a confidential strategy session

Pricing

How we price

Most of our work has a defined scope and output. Executive Advisory starts with a discovery workshop so the proposal reflects your mandate, priorities and reporting needs. Indicative fees are shared with organisations considering our work. Your final fee is confirmed in a written proposal.

All fees in Australian dollars, excluding GST

Request indicative fees See every engagement

The index

Every engagement, and how it is priced

Virtual CISONamed, accountable security leadershipFromOn requestMonthly retainerEngagement models →Virtual Chief AI OfficerNamed, accountable AI leadershipFromOn requestMonthly retainerEngagement models →Executive AssessmentSecurity, AI or executive readinessFromOn requestTwo to three weeksWhat's included →The SprintTwo weeks, credited against a retainerFixedOn requestTwo weeksWhat's included →AI Security services9 servicesFromOn requestFixed, from or scopedSee the rate table →Cybersecurity services12 services, including two Australian frameworksFromOn requestFixed, from or scopedSee the rate table →Executive Advisory and Security TransformationBespoke programmesScopedOn requestAfter a discovery workshopWhat that means →

Fixed means a defined scope at a set fee. From means a starting fee for a standard scope. Scoped means the fee follows a discovery workshop. Starting price. Final fixed fee confirmed in writing after scoping.

How we price

A fixed fee wherever the scope can be fixed

Most of our work has a defined scope, a defined output and a fixed fee. An assessment, a readiness programme and the Sprint can each be scoped before work begins.

Executive advisory is different. The mandate, your reporting needs and the obligations you are held to change the work, so it starts with a discovery workshop and a written proposal.

Indicative fees are shared with organisations considering our work. Your final fee is confirmed in a written proposal. Steve replies to every request personally, and nothing about requesting fees commits you to a call.

Executive advisory

Engagement models

Two roles, three levels each. The level is set by what you need us to own, not by the size of a package.

Virtual CISO

Named, accountable security leadership without the permanent hire.

EstablishFrom

Put a named security executive in place

Up to 2 days per month. A named executive and a monthly board-ready report.

On requestFinal monthly fee confirmed in writing after scopingRequest indicative fees

AssureFrom

Run security with evidence

Up to 4 days per month. Adds the risk register, committee attendance and vendor or AI use-case reviews.

On requestFinal monthly fee confirmed in writing after scopingRequest indicative fees

LeadScoped

Take the executive seat

Scoped in discovery. Adds an executive seat, board attendance and business-hours incident on-call support, within the limits set in the proposal. No 24/7 SOC service.

On requestFinal monthly fee confirmed in writing after scopingRequest indicative fees

Virtual Chief AI Officer

Named, accountable AI leadership across strategy, governance, risk, security and board reporting.

EstablishFrom

Put an AI owner in place

Up to 2 days per month. A named executive and a monthly board-ready report.

On requestFinal monthly fee confirmed in writing after scopingRequest indicative fees

GovernFrom

Govern the AI already in use

Up to 4 days per month. Adds the risk register, committee attendance and vendor or AI use-case reviews.

On requestFinal monthly fee confirmed in writing after scopingRequest indicative fees

LeadScoped

Take the AI executive seat

Scoped in discovery. Adds an executive seat, board attendance and business-hours incident on-call support, within the limits set in the proposal. No 24/7 SOC service.

On requestFinal monthly fee confirmed in writing after scopingRequest indicative fees

Beyond these levels, for multi-entity groups or programmes running alongside a major assurance effort, we scope the work in a discovery workshop. What that involves

First steps

Bounded ways to start

A defined piece of work with a defined output, before any retainer decision.

Two to three weeksFrom

Executive Assessment

Interviews, document review, a risk register and an executive readout. Typical duration: two to three weeks.

On requestSecurity, AI or executive readinessRequest indicative fees

Two weeksFixed

The Sprint

Two weeks of focused work to turn priorities into a remediation roadmap with owners and costs.

Credited in full against a retainer started within 60 days. Conditions apply.

The credit applies to a vCISO or vCAIO retainer signed within 60 days of the Sprint readout. It is applied across the first three months of retainer fees, with one credit per client and no cash value.

On requestRequest indicative fees

Not ready to spend anything? The Free AI Risk Self-Assessment is fifteen questions and about five minutes. Your result is on screen before we ask for anything. We won't contact you unless you ask us to.

Take the self-assessment

Services

Services, scope and pricing mode

Every service with what it produces, how long it usually takes and how it is priced. Select a service for the full scope.

AI Security

Service	What it produces	Duration	Mode	Fee
AI Governance & Responsible AI	AI governance framework	10 to 14 weeks	From	On request
ISO 42001 Readiness	An audit-ready AI management system	12 to 20 weeks	From	On request
AI Security Readiness Assessment	Scored readiness position	4 to 6 weeks	Fixed	On request
AI Risk Assessment	Rated AI risk register	3 to 5 weeks	From	On request
AI Governance Starter	Minimum viable AI policy	2 weeks	Fixed	On request
AI Security Architecture & Threat Modelling	Threat model	6 to 10 weeks	From	On request
AI Red Teaming & LLM Security	Adversarial findings report	4 to 8 weeks	From	On request
AI Agent Security	Agent permission model	6 to 10 weeks	Scoped	On request
AI Incident Response & Monitoring	AI incident playbooks	5 to 8 weeks	Scoped	On request

Cybersecurity

Service	What it produces	Duration	Mode	Fee
Security Strategy & Roadmaps	Phased security roadmap	8 to 12 weeks	From	On request
Security Architecture & Zero Trust	Target-state architecture	10 to 16 weeks	Scoped	On request
Identity & Access Security	Identity control baseline	8 to 12 weeks	Scoped	On request
Cloud Security	Cloud control baseline	6 to 10 weeks	From	On request
Security Assessments	Control-mapped findings report	3 to 6 weeks	From	On request
ISO 27001 Readiness	Audit-ready ISMS with an Annex A evidence pack	16 to 24 weeks	From	On request
GRC & Third-Party Risk	Supplier risk framework and an assessed vendor register	8 to 14 weeks	From	On request
Continuous Compliance	Monitored control set with a quarterly evidence cycle	Ongoing	From	On request
Incident Response & Resilience	Tested response playbooks and an exercised escalation path	6 to 10 weeks	From	On request
Cyber Insurance Readiness	Insurer-ready control evidence pack and a gap register	4 to 6 weeks	Fixed	On request
Essential Eight ReadinessAU	Evidenced maturity rating and uplift plan	3 to 6 weeks	Fixed	On request
IRAP ReadinessAU	Assessment-ready system and evidence set	12 to 16 weeks	From	On request

Scoped engagements

Executive Advisory and Security Transformation

A discovery workshop defines the mandate, priorities and written proposal.

What changes the scope

01The size and shape of your organisation
02The systems and environments in scope
03The evidence you already hold
04The obligations you are held to
05Your timeframe

Your fee is confirmed in a written proposal before any work begins, with the scope it covers and what falls outside it.

The proposal

What you agree to, before any work begins

Every proposal sets out

The named lead and agreed mandate.
Scope, deliverables and exclusions.
Reporting, responsibilities and timing.
Fees, billing and third-party costs.
Applicable notice and exit terms.

Paid separately

Certification audits, paid directly to the certification body at its own rates
Third-party licences, GRC platforms and technical products, set by the vendor
Personnel screening, where your obligations require it
24/7 security operations monitoring, which is not part of any engagement level

Questions

Pricing questions

How much does a vCISO cost?

A vCISO costs a fixed monthly fee, scoped to your size, regulatory exposure, mandate and reporting. Request indicative fees and Steve replies personally with the fee sheet. Your final fee is confirmed in writing after scoping.

Are indicative fees final quotes?

Indicative fees are starting points for an agreed scope. Your environment and obligations can change the work required. We confirm the final fee in writing.

Are certification costs included?

Certification costs are separate from our advisory fees unless expressly stated. Your proposal identifies the relevant third-party costs. Certification bodies set their own audit fees.

Can I discuss scope before requesting fees?

You can discuss scope in a confidential strategy session. We review the mandate and the work needed. You can then decide on the next step.

Are there expenses on top?

Expenses are not billed on routine work. Where a real cost needs to be passed through, we discuss it with you before we invoice it.

Request indicative fees

See indicative fees for your organisation

Our fee sheet is shared with organisations considering our work. Steve reviews each request and replies personally. The final fixed fee is confirmed in writing after scoping.

Prefer to talk first? A confidential strategy session is 45 minutes with the executive who would lead the work, not a salesperson.

Book a confidential strategy session Request by email

Your details

Indicative fees are shared on request and confirmed in writing after scoping. All fees are in Australian dollars and exclude GST. Corporate and supplier information is on About.