Pricing — built for accountability, scoped to your risk surface.

Because pricing is scoped to your risk surface — number of users, regulatory overlay, tooling baseline, geographic spread, and incident history. Published bands are indicative starting points; the proposal reflects what your environment actually requires. Pricing transparency at the band level qualifies leads pre-call without forcing us to misrepresent fixed prices for variable scope.

Standard term is 12 months on all recurring tiers (Core IT, Secure Operations, Fortress SOC, AI Governance Foundation, AI Governance Operations). Month-to-month is available on Core IT only at a premium and is typically used for M&A diligence, pre-launch programs, or short-engagement transitions. AI Risk Audit and AI Pen-Test are fixed-fee one-time engagements with no recurring commitment.

Yes. Onboarding is a separate fixed-fee, disclosed in the proposal, scoped to environment size and complexity. It covers discovery, tenant baseline, agent deployment, runbook authoring, and the first 30 days of stabilization. Onboarding is not bundled into the recurring fee — so you see exactly what you are paying for and when. Typical onboarding fees range from ~$5,000 (small Core IT environment) to ~$50,000+ (multi-site, multi-region, regulated Fortress SOC deployment).

Per-active-user billed against your seat count at the start of each quarter, with a quarterly true-up. The published bands ($175/user for Core IT, $275/user for Secure Operations) apply to active users in scope, subject to the monthly minimums ($2,500/mo for Core IT, $5,000/mo for Secure Operations) which prevent the model from breaking on very small seat counts. Fortress SOC is flat-fee for up to 50 users / 75 endpoints with metered additions above that band, defined in the engagement letter.

Tier downgrades are available at the next billing anniversary with 60-day notice. Mid-term downgrades are subject to scope renegotiation — typically possible without penalty if the environment has materially changed (M&A divestiture, headcount reduction, regulatory scope contraction). We document the path in the engagement letter so the decision is not a surprise on either side.

Yes. 24-month commitments typically carry a 5-10% discount on recurring fees; 36-month commitments carry a 10-15% discount. Exact discount bands are disclosed in the proposal and depend on tier, scope, and payment terms (annual prepay carries the largest reduction). We do not offer multi-year discounts on AI Risk Audit, AI Pen-Test, or other fixed-fee one-time engagements.

First-month invoice composition: onboarding fee (one-time, fixed) + first month of recurring tier fee + any pre-purchased third-party licenses (M365, EDR, SIEM ingestion) + any hardware procured through EFROS. Every line is itemized in the engagement letter before signature. There are no setup-fee surprises after the proposal is countersigned.

Both. Project work with defined scope is quoted as fixed-fee (migrations, M&A IT integrations, compliance attestation prep, AI Risk Audit, AI Pen-Test). Ongoing capacity for unscoped work is sold as a block-of-hours retainer at a documented hourly rate disclosed in the engagement letter. Recurring program tiers (Core IT, Secure Operations, Fortress SOC) cover all included-scope work without hourly billing — the project / retainer construct is only used for work outside the recurring scope.

Eligible 501(c)(3) non-profits and accredited educational institutions receive a 10-15% discount on recurring tiers, subject to verification of status. The discount does not apply to third-party software pass-through (Microsoft 365 nonprofit pricing already applies through Microsoft directly), hardware, or fixed-fee one-time engagements. Faith-based and community-mission organizations within these categories are eligible on the same terms.

Regulated overlays carry a documented premium reflecting the additional controls, evidence work, BAA / DPA management, and audit-support burden. Typical premium bands: HIPAA +10-15%, PCI-DSS +15-20% (scope-dependent), CMMC L2 +20-30%, CMMC L3 quoted separately. The premium is disclosed line-by-line in the proposal — never folded silently into the base rate. Multi-overlay environments (e.g. healthcare payment processor with HIPAA + PCI scope) compound additively but rarely above +35% total.