How the number gets decided.
No rate card, because scope decides the figure. Every engagement is fixed scope and fixed fee: the scoping call is free, the quote is written, and nothing changes without your approval. If a project does not need the full scope, I will say so.
Assessment
Web app, API, cloud or infrastructure testing
Basis
Fixed scope, fixed fee
- Written scope and rules of engagement
- Manual testing plus tooling where it helps
- CVSS-scored findings with reproduction steps
- Executive summary for the budget holder
- One retest window
Detection build
Wazuh deployment, tuning or a detection review
Basis
Fixed scope, fixed fee
- Architecture and sizing
- Log ingestion and parsing
- Correlation rules and file integrity monitoring
- Dashboards and analyst runbook
- Knowledge transfer with your team
Retainer
Bounty triage, detection tuning or steady testing capacity
Basis
Monthly, reserved hours
- Reserved hours each month
- Weekly written updates
- Priority response
- Quarterly review of what changed
Fees are quoted excluding VAT where applicable. Travel is not required for remote engagements.
Four things, honestly.
Quotes differ for reasons, not because the number is pulled out of the air. These are the variables that matter.
Surface area
One API is not the same as five applications, three roles and a mobile client. Scope is counted in endpoints and roles, not in days.
Access and environment
A staging environment that mirrors production is cheaper to test than production under a narrow window. Source access also lowers the effort.
Reporting depth
A technical report is the baseline. Executive summaries, developer walkthroughs and remediation support are added deliberately, not by default.
Urgency
A two week window with a fixed start costs more than a month. I would rather say so up front than pad a quote.
What you get either way.
These are not upsells. A report without reproduction steps or a retest is not a deliverable, it is a document.
How we work together- Written scope and rules of engagement
- CVSS-scored findings with reproduction steps
- Remediation guidance your developers can use
- Executive summary for the budget holder
- One retest window after the fixes
- A closing walkthrough with your team
Do you charge for the scoping call?
No. The first call and the written scope are free. You get a fixed quote before anything is scheduled, and there is no obligation to proceed.
What if the scope changes mid-engagement?
It is quoted and approved in writing before the extra work happens. No surprise line items on the final invoice.
How are payments structured?
Typically 50 percent on signature and 50 percent on delivery. Retainers are invoiced monthly in advance. Bank transfer or card, whichever your finance team prefers.
Do you work with small budgets?
Sometimes. A single API or a focused review is a legitimate starting point, and I would rather scope something small and useful than oversell a full programme.
Get a fixed number in writing.
Describe the system and the deadline. You will get a written scope, a fixed fee and a start date, or an honest reason why this is not the right engagement.
Typically replies within one business day. NDA on request.
hello@enesismaili.com