EVERY PACKAGE
Executive summary
The material risks in your agreed scope, explained for the people making business decisions.
INDEPENDENT CYBERSECURITY REVIEW
IT Security Audits & Assessments
Understand where your security controls fall short and what to fix first.
Get an independent assessment of your systems, access and security practices, with an executive summary and remediation priorities for your agreed scope.
From $5,000
Essentials auditScope and fixed price agreed upfront.
Led by Alexander Sverdlov200+ assessments · 14 countries
WHAT YOU RECEIVE
Clear findings.
Practical next steps.
Understand your security posture, the gaps that matter and the order to fix them. Choose the reporting depth your team needs.
EVERY PACKAGE
Remediation priorities
What to fix, why it matters and which actions should come first.
COMPREHENSIVE & ENTERPRISE
Technical detail & roadmap
Documented findings, supporting evidence and an Information Security Program Plan for your team.
The written scope sets the systems, checks and outputs included. See package details →
YOUR AUDITOR
Work directly
with Alexander.
Alexander Sverdlov
Former Microsoft Security Consulting
CISSP · CEH · CHFI · Mandiant certified
Alexander leads your scope discussion, reviews the controls and explains the findings to your team.
How to get your team behind the changes.
“Alexander is professional, reliable and available. He is clearly an expert in his field. Building trust in cybersecurity is obviously essential and Alexander has constantly demonstrated that my trust is well-placed.”
Principal, GNE Advisory
“The assessment was really imposing and remarkable. It was beyond my expectations, very detailed, and things were very closely inspected and discussed. It was a great experience working with you.”
Manager IT Infrastructure, Qordata
SEE THE DELIVERABLE
Read a sample.
No form needed.
Open six pages: an executive summary, scope, control-family results and a detailed finding with corrective actions.
Open sample excerptIllustrative report. Northbridge Components Ltd. and its findings are fictional.
Every packageExecutive summary & remediation priorities.
Comprehensive & EnterpriseDetailed technical findings & programme plan, within the agreed scope.
Want the full 89-page example?
Get the full sample report.
89 pages. We’ll email you a download link.
ILLUSTRATIVE AUDIT REPORT6-PAGE EXCERPT
From a management overview to an actionable finding.
WHAT WE REVIEW
Your systems.
Your security gaps.
An information security assessment can cover these areas. We agree the environment, criteria and depth before the work starts.
Identity & access
Accounts, authentication, administrator privileges and access to sensitive data.
Infrastructure & cloud
Endpoints, networks, servers and the cloud environments in your scope.
Detection & recovery
Logging, alerts, incident procedures, backups and recovery evidence.
Security governance
Policies, ownership, supplier risks and how controls work day to day.
Software & DevSecOps
Development practices, secrets, dependencies and delivery pipelines in broader packages.
Framework gaps
Controls assessed against your agreed criteria. One framework in Essentials; wider mapping in broader packages.
Framework-led, environment-specific. NIST SP 800-53 can structure the review across 20 control families. Applicable controls and test depth follow your scope.
Certification and exploitation-based testing are separate. Need a Microsoft 365 audit or penetration test?
PACKAGES & PRICING
The scope you need.
A price agreed upfront.
Three starting points. Your written proposal confirms the coverage, deliverables and fixed price.
Essentials Audit
Focused audit for startups and small teams.
From $5,000per engagement
- Up to 50 employees
- Single compliance framework
- Cloud or on-prem (single environment)
- Executive summary report
- Remediation priority list
- 14-day delivery target, subject to agreed access and evidence
Most Popular
Comprehensive Audit
Full-scope audit for growing companies.
From $12,000per engagement
- Up to 500 employees
- Mapping to agreed frameworks (for example NIST or ISO 27001)
- Cloud + on-prem environments
- M365 / Google Workspace / AWS security review
- Secure Software Development (SSDLC) review
- DevSecOps pipeline audit (CI/CD, SAST, DAST, SCA)
- Executive & technical reports
- Information Security Program Plan
- Interactive consulting sessions
- 30-day follow-up Q&A
Enterprise Audit
Multi-entity, multi-country audit programs.
From $25,000per engagement
- 500+ employees, multiple locations
- Mapping to the frameworks agreed in your scope
- Hybrid cloud + on-prem + remote workforce
- M365 / Google Workspace / AWS / Azure / GCP security review
- Secure Software Development (SSDLC) review
- DevSecOps pipeline audit (CI/CD, SAST, DAST, SCA)
- Board-ready executive presentation
- Full Information Security Program Plan
- Vendor & supply chain risk review
- Dedicated engagement manager
- 60-day follow-up support
Compare scope & deliverablesSystems, evidence, outputs and delivery conditions
| Package | Systems & controls | Evidence you provide | What you receive | Delivery & boundaries |
|---|---|---|---|---|
| Essentials AuditFrom $5,000Up to 50 employees | Selected access, configuration, resilience and information security controls in one agreed cloud or on-premises environment, assessed against one framework. | System inventory, relevant access and configuration exports, policies, backup records and the named people responsible for the selected controls. | Executive summary and a prioritised remediation list for the agreed scope. | Single environment and framework. A 14-day delivery target starts at kickoff when the agreed access and evidence are ready. Detailed technical reporting and cross-environment reviews are not automatically included. |
| Comprehensive AuditFrom $12,000Up to 500 employees | Agreed cloud and on-premises systems; Microsoft 365, Google Workspace and AWS where applicable. Secure software development and DevSecOps practices, with mapping to the agreed frameworks. | Environment and application inventories, scoped read-only access or configuration exports, control evidence, relevant development/pipeline records and interviews with system owners. | Executive and technical reports, prioritised remediation, an Information Security Program Plan, consulting sessions and 30-day follow-up Q&A. | Systems, framework mappings, sampling and test depth are specified in the proposal. Delivery depends on the agreed scope and evidence availability; the Essentials 14-day target does not apply automatically. |
| Enterprise AuditFrom $25,000500+ employees / multiple locations | Agreed multi-entity and hybrid environments, cloud platforms, remote access, secure development and DevSecOps, plus vendor and supply-chain risks. | Entity and system inventories, access and control evidence across agreed locations, supplier records and interviews with business and technical owners. | Executive and technical reporting, a board-ready presentation, full Information Security Program Plan, a dedicated engagement manager and 60-day follow-up support. | Entities, locations, platforms, framework coverage and reporting requirements are agreed explicitly. Your proposal sets milestones, dependencies and delivery dates. |
What changes the price?
Entities, environments, system complexity, frameworks, testing depth and reporting needs.
When will it be ready?
Essentials targets 14 days once access and evidence are ready. Broader engagements have agreed delivery dates.
When do you pay?
Review your report before payment under the written terms agreed for your engagement.
HOW IT WORKS
A clear route
from scope to action.
Whether you need an independent risk assessment, board assurance or answers for a customer review, start with the decision you need to make.
01
Agree the scope
Systems, deliverables, fee and delivery date. Confirmed in writing.
02
Review the evidence
Configuration, records, interviews and authorised checks.
03
Prioritise the gaps
Validate observations and connect each finding to its risk and fix.
04
Review the results
Walk through your reports, priorities and agreed follow-up.
Audit or assessment — which do I need?
Both start with your business question. An audit reviews controls against agreed criteria; a posture or risk assessment looks at weaknesses and their business impact. We can combine these with gap analysis in one clearly scoped engagement.
What does the starting price include?
Essentials starts at $5,000: one environment, one framework, an executive summary and remediation priorities. Comprehensive starts at $12,000 and Enterprise at $25,000. Their wider coverage and additional reports are not included in Essentials. We confirm the scope and fixed price before work begins.
How long will it take?
Essentials targets 14 days from kickoff, once the agreed access and evidence are ready. Comprehensive and Enterprise timelines depend on scope. Your proposal confirms the delivery date and what we need from your team.
What access will you need?
We agree the system inventory, configuration exports, policies, records, interviews and any read-only access needed for the selected checks. Evidence is shared through agreed secure channels. Do not send passwords or sensitive records through the enquiry form.
Will this help with a board or customer review?
Yes. We tailor the agreed review and reporting to the decision you need to make — whether that is reducing exposure, answering a board request or getting a stalled customer security review moving. Tell us who needs the findings and why.
Does this include certification or a penetration test?
No. This is an independent security review. Framework mapping can support readiness but does not issue a certification, accreditation or SOC 2 report. Exploitation-based penetration testing is scoped separately.
Do I need a meeting or an upfront payment?
You can start by email using the form; a scheduled online meeting is optional. Scope, price, delivery and payment terms are agreed in writing. You review the report before payment under those agreed terms.
NEXT STEP
Let’s scope your audit.
Start by email, or choose a 30-minute online meeting.