Start without a retainer.
A sprint is a single fixed-price engagement with a defined deliverable and an end date — the fastest way to get a concrete result and see how we work before committing to anything ongoing.
DMARC Enforcement Sprint
Stop scammers sending email as your company, without blocking your real mail — the proof insurers and auditors now require.
Cloud Bill Sprint
Cut AWS/Azure/GCP spend and stop cost creep — implementation included, not just a report.
Cloud & DevOps Audit Sprint
Find cost, security, and reliability risk in your infrastructure — three quick-wins shipped, not just findings.
HIPAA Risk Analysis Sprint
The Security Risk Analysis HIPAA requires, quick-win controls closed, and an OCR- and MIPS-ready roadmap — for practices without IT.
SOC 2 Readiness Sprint
Honest gap assessment, first controls shipped, and an auditor-ready roadmap — for teams facing a deal that requires SOC 2.
Which sprint fits your situation?
Each sprint answers one specific trigger. Find yours, then see what you leave with.
| If this is you | Sprint | You leave with |
|---|---|---|
| A customer or prospect asked for your SOC 2 report | SOC 2 Readiness Sprint $5,000 · 30 days | A gap assessment against your real environment, 3–6 controls fixed, and a Type I / Type II roadmap |
| You handle patient data and have never done a HIPAA Security Risk Analysis | HIPAA Risk Analysis Sprint $5,000 · 30 days | The Security Risk Analysis HIPAA requires, a risk register, 3–6 quick wins closed, and a vendor BAA gap list |
| Your cyber insurer or an auditor wants proof your domain enforces DMARC | DMARC Enforcement Sprint $2,500 per domain · 30 days | Your domain at p=reject with every legitimate sender aligned, plus an evidence pack |
| Your cloud bill keeps growing and nobody owns it | Cloud Bill Sprint $5,000 · 14 days | The top agreed savings implemented in 14 days, budgets and anomaly alerts, and a 180-day plan |
| You inherited AWS infrastructure and don't know where the cost, security, or outage risks are | Cloud & DevOps Audit Sprint $5,000 · 30 days | Cost, security, and single-point-of-failure findings, 3 quick wins shipped, and a 30/60/90-day roadmap |
Why a sprint instead of a proposal
Sprint questions
Do I have to sign a retainer after a sprint?
No. A sprint is a standalone engagement with a fixed price and an end date. You keep every deliverable. If you want ongoing help, the sprint's roadmap becomes the starting plan for a monthly retainer, but nothing commits you to one.
What's the difference between the Cloud Bill Sprint and the Cloud & DevOps Audit Sprint?
The Cloud Bill Sprint is 14 days and only about cost: we implement the top agreed savings and set up budgets and anomaly alerts. The Cloud & DevOps Audit Sprint is 30 days and covers cost, security posture, and reliability risk across your AWS environment, with three quick wins shipped.
We already use Vanta or Drata. Do we still need the SOC 2 Readiness Sprint?
Often, yes. A compliance platform automates evidence collection, but it can mark a control green that an auditor would still question. The sprint checks your controls against how your environment actually works and fixes the first gaps. See our Vanta vs Drata vs Secureframe comparison for how the platforms differ.
What does a sprint need from our team?
A point of contact who can make decisions and access to the systems in scope, both agreed on the scoping call. Senior PlatOps engineers do the work; your team reviews findings and approves changes.
Why is the DMARC sprint priced "from" $2,500?
The price depends on how many domains and sending services are in scope. A single domain with a few senders sits at the starting price; we quote anything larger on the scoping call before work starts.
Comparing compliance platforms first? Read Vanta vs Drata vs Secureframe.
Not sure which sprint fits?
Book a 1-hour scoping call and we'll point you to the right one — or tell you honestly if a sprint isn't the right move.