The prices are on the website, which shouldn't be unusual.
Every engagement is fixed price, agreed in writing before I start. If the work grows, we agree the change first — you will never open an invoice you weren't expecting.
3–4 weeks. Scales with headcount and how many systems are in play. A 15-person services firm sits near the bottom; a 100-person company with multiple sites sits higher.
Details → Security frameworks & control coverage2–4 weeks. Scales with how many systems and how many frameworks you need mapped.
Details → AI use policy2 weeks. Flat for most small businesses; more if you're regulated or AI sits inside your own product.
Details → AI agents & tools3–6 weeks. Quoted after we look at your documents and your real workflow.
Details → Websites & internal tools2–4 weeks. Marketing sites near the bottom; tools with logins and stored data cost more.
Details → Penetration testing (light)1–2 weeks. Scales with how many systems and domains are in scope. Always with written authorization first.
Details →Two things at once costs less than two things.
Because most of the cost is understanding how your business works, and I only have to do that once.
Security & planning + AI use policy
The most common pairing. The AI policy is discounted when it runs alongside the planning program, since the discovery work overlaps almost entirely.
Frameworks & coverage + light pen test
For proving to a customer that you're secure. Map your coverage, then have the obvious ways in checked — the proof and the pressure-test in one engagement.
The boring parts, stated plainly.
Payment
Half on signature, half on delivery. Over $10,000 we can split across three milestones instead. Invoices net 30. I'll fill out your vendor onboarding paperwork without complaining about it.
Ownership
Everything I produce is yours on final payment — source code, editable documents, all of it. I retain no rights and I don't reuse your material with anyone else.
Confidentiality
I'll sign your NDA. If you don't have one, I'll bring mine. I don't name clients publicly without written permission, which is why the work on this site is described without naming who it was for.
Conflicts
I decline any engagement that would conflict with my public-sector work. If a conflict surfaces mid-project, I'll tell you immediately and refund the unearned portion.
About the money specifically.
Why fixed price instead of hourly?
Because hourly billing means you're paying for my learning curve and quietly hoping the work goes slowly for neither of us. Fixed price puts the estimation risk on me, which is where it belongs — I've done this before and you haven't.
What if the work turns out bigger than expected?
If I underestimated, that's mine to absorb. If you add scope, we agree the change and the cost in writing before I do any of it. The distinction is clear in practice and I'll be the one raising it, not you.
Do you offer discounts for nonprofits?
Yes, and I don't make you argue for it. Ask on the intake form and tell me roughly what your budget looks like.
Is there a payment plan?
The milestone split usually solves this. If cash flow is genuinely tight, say so and we'll work something out — I'd rather do the work than have you go without it.
What if I need something not listed here?
Ask. If it's near what I do, I'll quote it. If it isn't, I'll tell you and point you somewhere better, which happens more often than you'd expect.
Get an actual number.
Describe the situation and I'll come back with a fixed price and a date, or with a reason you don't need to spend anything.
Get in touch