Sign a 2-year agreement with pricing locked in upfront, and we'll deliver your first year of any one service, from penetration testing to ISO 27001 or SOC 2 preparation, at no cost. Year two runs at the exact rate agreed before you signed.
We're consultants. We'll get your controls in shape and get you ready for the audit, but we don't hand out ISO 27001 certificates or sign SOC 2 reports, because the rules quite rightly don't let the firm that prepared you be the firm that passes you. That job goes to an independent certification body or CPA firm, and we'll help you find a good one. More on where exactly that line sits in our independence statement.
The independence rules that keep us out of the certification and attestation business (see our independence statement) have nothing to do with how we price our own advisory work. Every service on this site, penetration testing, audit preparation, internal audits, vCISO support, risk and vendor assessments, is delivered directly by us. That means we can genuinely give away a full year of it for a new client, without ever touching the part of the process that has to stay independent.
Most new clients don't need just one thing. A company heading toward a first enterprise deal might want ISO 27001 certification preparation and a penetration test in the same year. Here's how that works:
| You choose | Year one pricing | Year two pricing |
|---|---|---|
| One service | Free | Fixed rate, agreed at signing |
| Two or more services | Highest-value service free, remaining services at a bundle discount | Fixed rate for every service, agreed at signing |
Which service counts as "highest-value" and the size of any bundle discount is confirmed with you in writing before you sign, alongside the full year-two price for every service included. Nothing is left to be worked out later.
A short call to scope which service, or services, you want in year one, and confirm your target dates.
You receive one agreement covering both years: your free service (or free-plus-bundle-discount, if you've chosen more than one), and the exact fixed price for year two across everything included.
One signature, two years of pricing already agreed. No renegotiation once you're in.
We deliver your first year exactly as scoped, then continue into year two at the price you already agreed, whether that's an ongoing internal audit cycle, a vCISO retainer, or a repeat penetration test.
Work outside the agreed scope, such as building an ISMS from scratch where none exists, or engineering work to implement fixes on your behalf. The certification audit or SOC 2 examination fee charged directly by your independent certification body or CPA firm is also separate, since that is not ours to set or waive.
Full delivery of your chosen service to the same standard as a paid engagement, including the one remediation cycle that comes as standard with every engagement we run. You get one round to apply fixes to what we raised, we re-check those findings, and the final report reflects your corrected state. You also get a written year-two price for everything before you commit to anything.
Penetration testing, ISO 27001 internal audit, ISO 27001 certification preparation, SOC 2 Type I and Type II preparation, risk assessment, and vendor risk management. If the service has a mid-cycle checkup (Eg. mock audit 6 months and 1 month before audit kickoff then you'll only get 1 audit as part of the offer for free and not both)You choose which one is your free service when you sign. Services such as vCISO and custom consulting does not qualify. Our team will be very clear on which one clarifies as the free offer and everything will be confirmed through a signed agreement.
Tell us all the services you want and we'll structure it so your highest-value pick is free and everything else in that first year is priced at a bundle discount, agreed and written into the same agreement before you sign.
You'll continue on the pricing fixed into your agreement at signing, for every service you're running. No renegotiation, no surprise increases. The whole point of locking in upfront is that you know exactly what year two costs before you commit to year one.
The offer is structured as a 2-year agreement because that's what makes a genuinely free first year viable for us. We'll always talk through your situation if circumstances change, but the agreement is written for two years and priced accordingly.
It includes the one remediation cycle that comes as standard with every engagement we run, free year or not. You get one round to submit fixes for the findings we raised, we re-check those specific findings, and the final report reflects your corrected state rather than the position we found at the start. On a penetration test that is a re-test; on an internal audit it is a re-check of the corrective actions; on a readiness assessment it is a re-review of the closed gaps. What sits outside it is our engineers implementing the fixes on your behalf rather than verifying yours, and any further rounds beyond the first. Both are quoted separately before any work starts.
Because our free offer covers our own advisory and preparation work. The certification audit itself is always performed by an independent accredited certification body, and the SOC 2 examination by an independent CPA firm, both of which are separate paid engagements you arrange directly with them. We can't discount or waive a fee that isn't ours to set, and doing so would blur the independence line described in our independence statement.
A 20-minute call is all it takes to confirm eligibility and walk through the agreement.
Book your eligibility call