The Security Readiness Check starts at the agreed fee for one entity and one site. It is an advisory review; technical testing, remediation and physical security are excluded. Wider assessments, retained leadership and private AI are quoted privately, with a fixed scope and fee in writing.
Three lanes, one ladder, for your own program. Assess tells you where you stand. Run gives you a senior security leader on a fraction of a hire. Private AI puts a governed AI workspace inside your AWS account and keeps it operated. Most clients start on the left and move right only when the findings warrant it. Diligence stands apart from that ladder: it reviews a company you are acquiring, not your own program, for private equity and search-fund buyers after close.
What is public. The Security Readiness Check starts at the agreed fee for one entity and one site. It is an advisory review, excluding technical testing, remediation and physical security. Other services receive a private fixed-fee proposal.
What moves the number. Additional sites or entities, more users or AI systems in scope, an examined regulatory profile, and multi-environment deployments change the scope and fee. The scoping call sets the final fee, in writing, before work starts. Nothing here is billed hourly. Readiness and advisory work is not certification and not legal advice.
Each Assess engagement is scoped to one entity and one site in the written scope. They are advisory reviews of the evidence you already have and the controls you already run. None of them is a penetration test (DSE runs that separately as penetration testing), and none of them certifies anything.
Fit: small and mid-sized firms, roughly 10 to 150 staff, taking a first structured look. Metro-Atlanta clients can have this done in person.
Term: one-time, fixed fee. Estimate vs fixed: the advisory review covers one entity and one site; the scoping call confirms the scope and fixed fee in writing.
Scope a Readiness Check →Fit: 25 to 250 staff handling client financial data, PHI, or contract-sensitive data, usually under insurer, customer, or regulator questionnaire pressure.
Term and fee: confirmed in a private written proposal, including any setup fee, cadence, minimum term, responsibilities and exclusions.
Scope a Foundations Assessment →Fit: any firm that needs a documented, evidenced training program for insurers, clients, or a HIPAA or GLBA obligation. The written scope confirms the user count.
Term and fee: confirmed in a private written proposal, including any setup fee, cadence, minimum term, responsibilities and exclusions.
Scope awareness training →Physical-security delivery is in development and is not part of these engagement scopes. Any future physical engagement would require a confirmed specialist provider and documented contracting and delivery responsibilities.
This is diligence on a target's security posture, run for the acquirer after close. Regulated-data scope affects the evidence requirements; we confirm the deliverables, access, exclusions and fixed fee privately before work starts.
Fit: private equity firms, search funds, and independent sponsors that could not get system access to a target before close, and need a risk-ranked findings report plus a 100-day remediation roadmap once they can.
Term and fee: confirmed in a private written proposal, including any setup fee, cadence, minimum term, responsibilities and exclusions.
Scope the post-close review →Full scope, sample findings, and FAQ: Post-Close Cybersecurity Review for PE Acquirers.
Every vCISO tier carries a six-month minimum and a one-time setup fee that covers the first-30-day baseline: risk register, policy inventory, and the evidence calendar. DSE directs the program; DSE does not operate a 24/7 SOC or MDR, and continuous monitoring, where required, runs through a vetted partner you contract.
Fit: 25 to 150 staff, no in-house security lead, building a first security program that a client or insurer will ask to see.
Term and fee: confirmed in a private written proposal, including any setup fee, cadence, minimum term, responsibilities and exclusions.
Scope vCISO Essentials →Fit: 100 to 500 staff under GLBA, HIPAA, or state privacy obligations, with AI already in use and a board or owner that wants reporting.
Term and fee: confirmed in a private written proposal, including any setup fee, cadence, minimum term, responsibilities and exclusions.
Scope vCISO Core →Fit: examined entities: banks, credit unions, RIAs and broker-dealers, insurers, healthcare systems, and defense suppliers, often multi-entity, usually 250+ staff.
Term and fee: confirmed in a private written proposal, including any setup fee, cadence, minimum term, responsibilities and exclusions.
Scope vCISO Regulated →Looking for AI-program-only leadership? The narrower vCISO for AI retainer is quoted privately for its narrower scope. The tiers above run the whole security program, with AI risk inside it.
Private AI engagements deploy PrivateStack, DSE's governed AI workspace built on open-weight models, or an equivalent reference stack, inside a customer-owned AWS account and VPC under customer-managed keys. Under that Enterprise BYOC deployment, prompts, completions, retrieval documents, and audit logs remain in your VPC; control-plane metadata is the documented exception. The BYOC boundary map spells out every data path.
Fit: one high-value workflow on sensitive data, one team, one environment. The right first buy when the hosting boundary is the blocker.
Term and fee: confirmed in a private written proposal, including any setup fee, cadence, minimum term, responsibilities and exclusions.
Scope a Private AI Pilot →Fit: several workflows across several teams, regulated data, and a reviewer, auditor, or examiner who will ask for the control path.
Term and fee: confirmed in a private written proposal, including any setup fee, cadence, minimum term, responsibilities and exclusions.
Scope a Private AI Foundation →Fit: a private AI system already in production that needs to stay patched, tested, and evidenced without a dedicated internal team.
Term and fee: confirmed in a private written proposal, including any setup fee, cadence, minimum term, responsibilities and exclusions.
Scope managed operations →The product path: PrivateStack is the governed AI workspace these engagements deploy. Its Hosted and Solo tiers run on DSE-managed infrastructure and do not inherit the BYOC residency posture described here.
Multi-entity, multi-environment and regulated programs need a private proposal. We define the deliverables, evidence requirements, responsibilities and fee for your estate.
A principal reads the request, replies within 24 hours with fit or not-fit, and, if it is a fit, sends a fixed-fee scope document within 48 hours of the scoping call. Enterprise work is priced to the estate, in writing, before anything starts.
Request custom pricing →Straight answers on the starting scope, private proposals, scope changes and engagement letters.
No. The starting advisory review covers for one entity and one site. We confirm your requirements, exclusions and fixed fee in writing before you commit. Testing, remediation and physical security are excluded.
Four things, in roughly this order: scope units (sites, entities, environments, AI systems), regulatory profile (an examined entity needs more evidence than an unregulated one), user or workflow count for the per-month lines, and delivery constraints such as in-person requirements or a procurement vehicle. None of them is headcount for its own sake.
Yes. The scoping call produces a written scope with one fixed fee. Nothing is billed hourly. If the scope changes mid-engagement, the change is priced and agreed in writing before the work continues.
Engagement letters are issued only after our counsel-reviewed terms and errors-and-omissions coverage are in force for the scope. That is a standing gate on signing and delivery, not on scoping: you can scope, receive a fixed-fee proposal, and reserve a start window before it clears. We will tell you plainly where a given scope stands.
The starting scopes page lists the Security Readiness Check, AI Security X-Ray and Healthcare AI Readiness Snapshot. This page describes broader security scopes, which receive a private fixed-fee proposal.
DSE is not offering physical-security delivery through this website. We are developing a partner-enabled approach; any future delivery depends on a confirmed provider and agreed responsibilities. Continuous monitoring runs through a vetted MDR or MSP partner you contract; DSE directs the program and reviews the evidence but does not operate a 24/7 SOC.