Services
Every engagement is fixed fee with a written scope and rules of engagement agreed before testing begins, one round of retesting included, and a report with a signed attestation letter naming the practitioner who did the work.
Track A
Testing scoped to produce the evidence an assessor, auditor or examiner will actually accept — and an attestation letter with a named practitioner behind it.
from $18,000
Scoped to Level 2 and Level 3 evidence, mapped to the practices your assessor will test, with an attestation letter for the package.
Typical duration · 7–8 days
from $14,000
A manual, human-led test producing evidence against CC4.1 — and the artifact your enterprise customers ask for by name once they have read your SOC 2 report.
Typical duration · 6 days
from $16,500
Cardholder data environment scoping, segmentation validation, and Requirement 11.4 testing.
Typical duration · 7 days
Track B
The core work. Automated tooling runs the breadth; the hours you pay for go into exploitation, chaining, business-logic abuse, and the write-up.
from $9,500
Everything reachable from the internet: attack surface discovery, exposure analysis, exploitation, and a prioritised remediation plan.
Typical duration · 4 days
from $14,000
Authenticated testing across roles. OWASP coverage is the floor — the value is in access-control and business-logic flaws a scanner cannot model.
Typical duration · 6 days
from $14,500
AWS or Azure. Identity, network, and data-layer review, then exploitation of what the configuration actually permits.
Typical duration · 6 days
from $16,500
Starts from a foothold rather than arguing about whether one is possible. Lateral movement, privilege escalation, and Active Directory.
Typical duration · 7 days
Track C
The practice this firm is committing to. Not only the model — the infrastructure it trains on, the pipeline that feeds it, the agents that act on its output, and the architecture that is supposed to contain all three. Rarely available from a firm this size, because it needs someone who has done offensive work against shipping systems rather than someone who read the guidance last quarter.
from $16,000
Prompt injection, jailbreaks, tool and agent abuse, training and retrieval data leakage. Mapped to the OWASP Top 10 for LLM Applications and the NIST AI RMF Generative AI Profile.
Typical duration · 5 days
from $21,000
The red team engagement plus the documented evidence trail an ISO 42001 audit, a NIST AI RMF MEASURE/MANAGE mapping or an enterprise AI security review asks for.
Typical duration · 7 days
from $18,000
The path from data to deployed model, tested as an attack surface: ingestion and labelling, feature stores, experiment tracking, artefact registries, and the CI that promotes a model into production. Where a poisoned input or a writable artefact store turns into inference-time control.
Typical duration · 6 days
from $18,000
The estate the models actually run on. Identity and role assumption across training and inference accounts, GPU and notebook environments, vector store exposure, model and inference endpoint authorisation, and the tenancy boundaries between them.
Typical duration · 6 days
from $12,000
A design-stage review rather than a test: trust boundaries, tool and agent permissions, data flow and retention, tenant isolation, and the failure modes that a penetration test will find later and more expensively. Delivered as a findings register with a prioritised remediation sequence.
Typical duration · 4 days
from $4,500
A facilitated exercise built on a scenario specific to your business, with a written after-action report.
Typical duration · 2 days
Deliverable
A report that has to survive being read by someone who was not in the room — an assessor, an auditor, or your customer's security team.
One page, written for a reader who will not read the rest. What was tested, what was found, what it means for the business, and what to do first.
Each with severity, the evidence, reproduction steps that actually reproduce, business impact in your context rather than a generic description, and specific remediation.
Ordered by risk against effort, so the list is workable rather than merely complete.
Named practitioner, credentials, scope, dates and methodology. Signed. This is the page your assessor or customer asks for.
After you fix, Zero Harbor Security verifies, and the report is reissued showing what closed.
Rates
Retesting beyond the one included round, advisory time, expert witness support and anything scoped by the hour.
Scope
So the fixed fee stays fixed. If any of these apply, say so up front and the quote accounts for it.
Host counts, application count, number of user roles, and how many cloud accounts are in scope.
Out-of-hours or weekend testing, or a change freeze that compresses the window.
On-site internal or physical testing outside the Atlanta metro is billed at the day rate plus travel.
Compliance engagements that need practice-by-practice mapping take longer than a findings report.
One round is included. Further rounds are hourly.
A date inside three weeks, where it can be taken at all, carries a premium. Often it simply cannot.
Comparison
A continuous testing platform will sell you a year of automated external testing with unlimited retests for roughly the price of one thorough manual engagement. That is a real offer and for some organisations it is the right one.
Buy the platform if what you need is coverage — knowing quickly when something new is exposed, across a large and changing estate.
Buy an engagement if what you need is an artifact: a report an assessor, an auditor, an examiner or an enterprise customer's security review will accept, with a named practitioner attesting to it. A platform cannot sign anything, and the document has to survive being forwarded to somebody who was not in the room.
Most organisations past a certain size eventually need both.