Commercial portal · Private offers
Request a private offer.
Bundle AI security products, services, Academy training, and evidence work into a single enterprise engagement. Enterprise offers are scoped through a direct statement of work — tell us what you need and we’ll prepare a tailored proposal.
Private offers can be structured for AWS-compatible delivery when relevant, without requiring AWS Marketplace.
How the buying motion works
Get to yes without waiting on every process sequentially
We help product, security, legal, and finance get to yes quickly with a scoped review plan, approval packet, and evidence-ready deliverables. No-cost scoping means confidentiality, access boundaries, and review planning before paid work begins — not free consulting.
- 01
No-Cost Scoping Retainer
Confidentiality, access boundaries, and review planning before paid work begins. No-cost scoping does not mean free consulting.
- 02
NDA + Scoping Authorization
Mutual NDA, data-handling terms, and explicitly authorized testing boundaries so legal can move in parallel.
- 03
Fixed-Fee Launch Review
The scoped 5–10 business day pre-release review. First findings in 5 business days.
- 04
Private Offer / SOW
A tailored statement of work for the review and any follow-on work (e.g. the deeper 2–4 week assessment).
- 05
Legal + Finance Track
Vendor onboarding, procurement packet, invoice terms, and budget category — run alongside scoping, not after.
- 06
Technical Scoping Track
Architecture, access, prompts, RAG, agents, authz, logs, and test boundaries → a draft review plan.
- 07
Internal Approval Packet
Why now, business pressure, risk if delayed, expected deliverables, and the decision needed — ready to forward.
Launch Review Onboarding Kit
Artifacts your champion can forward internally
The first deliverable is a decision package, not just a report. Each asset is track-aware — copy or forward it.
AI Launch Review One-PagerForwardable summary of the offer, timeline, and positioning.Show copy-ready content ↓
AI LAUNCH REVIEW — ONE-PAGER Ship AI without letting customers, attackers, or enterprise security reviewers discover the weak points first. Track: Ship AI Soon → AI Launch Security Review Know what can break, what must be fixed before launch, and what evidence product, security, leadership, and buyers can rely on. Timeline: First findings in 5 business days. Launch-ready review in 5–10 business days. We help product, security, legal, and finance get to yes quickly with a scoped review plan, approval packet, and evidence-ready deliverables.
Internal Approval MemoMemo focused on release risk and a 5–10 business day pre-launch review.Show copy-ready content ↓
INTERNAL APPROVAL MEMO — AI Launch Security Review Why now: Launch in the next 30–60 days, private beta, public beta, GA, enterprise review, or release gate. Business pressure: We are launching an AI feature, copilot, RAG system, agent, or workflow soon and need launch-risk clarity fast. Focus: This engagement is about release risk and a 5–10 business day pre-launch review. What we are buying: AI Launch Security Review. Timeline: First findings in 5 business days. Launch-ready review in 5–10 business days. Budget category: Launch / AppSec / product security / red team / customer assurance. Note: This is a scoped pre-release review, not a platform migration or open-ended program build. Expected deliverables: • Launch Risk Memo • Abuse-Path Findings • Release Gate Checklist • Sprint-Ready Fix Backlog • Buyer-Ready Evidence Summary Who needs to approve: • Engineering/Product owner • Security/AppSec • Finance (fixed-fee) • Legal (NDA + authorized testing) Risk if delayed: Customers, attackers, or enterprise security reviewers discover the weak points first. Decision needed: Approve a no-cost scoping phase (NDA + access boundaries + draft plan) so legal, finance, and technical can move in parallel, then a fixed-fee SOW / private offer once scope is clear. Scope guardrails: • Not a rubber stamp. • Not a certification claim. • Not an open-ended governance program. • Not a platform migration. • Not production testing without explicit authorization.
Technical Access ChecklistWhat engineering/security provides for first findings.Show copy-ready content ↓
TECHNICAL ACCESS CHECKLIST — AI Launch Security Review To produce the draft review plan and first findings (5 business days), please prepare: • Architecture overview / data-flow diagram (or a 30-min walkthrough) • Demo or staging environment access (read-only is fine to start) • Prompts, system instructions, and tool/function definitions • RAG / retrieval sources and tenant-boundary description • Agent tools, permissions, approval paths, and rollback design • AuthN/AuthZ and identity-propagation notes • Logging, audit, and eval coverage (what exists today) • Test boundaries: what we may exercise, and what is off-limits Authorized-testing note: adversarial testing happens only within explicitly authorized boundaries (see NDA + Scoping Authorization).
Legal + Procurement PacketVendor, payment, and buying-motion details for finance.Show copy-ready content ↓
VENDOR / PROCUREMENT PACKET — aisecurity.llc Engagement: AI Launch Security Review Budget category: Launch / AppSec / product security / red team / customer assurance. Vendor profile: aisecurity.llc — AI product security engineering (red team, blue team, evidence). Payment: fixed-fee where possible; invoice terms available; private offer / SOW path. Security/assurance: trust-center materials and references available on request. Onboarding: we can complete standard vendor onboarding and security questionnaires. Buying motion: 1. No-Cost Scoping Retainer (NDA + access boundaries + draft plan) — no committed budget to start. 2. Fixed-Fee Launch Review (5–10 business days). 3. Private Offer / SOW for follow-on work (e.g. deeper 2–4 week AI Product Security Assessment). No-cost scoping does not mean free consulting. It means confidentiality, access boundaries, and review planning before paid work begins.
Draft Launch Review PlanMADE-aligned plan, timeline, and deliverables.Show copy-ready content ↓
DRAFT REVIEW PLAN — AI Launch Security Review MADE launch translation: • Map what is launching. • Attack what can be abused. • Defend what must hold. • Evidence what is safe enough to ship. Timeline: First findings in 5 business days. Launch-ready review in 5–10 business days. Deliverables: • Launch Risk Memo • Abuse-Path Findings • Release Gate Checklist • Sprint-Ready Fix Backlog • Buyer-Ready Evidence Summary The first deliverable is a decision package, not just a report.
Onboarding
Move four tracks in parallel
We put legal, finance, procurement, and technical scoping on parallel rails so the work can start without waiting on every internal process sequentially.
Technical Scoping
Output: Draft Launch Review Plan
- architecture
- demo/staging
- prompts
- RAG
- agents/tools
- authz
- logs/evals
- test boundaries
Legal
Output: NDA + Scoping Authorization
- mutual NDA
- data handling
- authorized testing boundaries
- confidentiality
- work-product terms
Finance / Procurement
Output: Procurement Packet
- vendor profile
- tax/payment details
- budget category
- fixed-fee quote path
- invoice terms
- onboarding answers
Internal Approval
Output: Approval Memo
- why now
- business pressure
- risk if delayed
- expected deliverables
- timeline
- decision needed
Readiness packet
Bundle a scoped pentest or red team engagement
A private offer can include scoped penetration testing, cloud review, or adversarial red teaming. Build the readiness packet first — targets, authorization, ROE, access, evidence handling, and deliverables — so the offer and SOW come together cleanly.
Readiness Packet
Pen Test & Red Team Readiness Packet
Cobalt-style onboarding for scoped security testing, adversarial review, cloud assessment, and AI/agentic red teaming.
- Scope Brief & Target Inventory
- Rules of Engagement & Authorization
- Access Plan & Evidence Handling
- Required contracts + Draft SOW inputs
Testing only proceeds against targets your organization owns, controls, or is explicitly authorized to assess.
Enterprise training
Request an Academy enterprise training packet
Team Pack, Enterprise LMS Package, Private Cohort, and White-Label Partner options available. Covers seat access, SCORM delivery, facilitator guides, Q&A checkpoint keys, manager reports, and enterprise training terms. SCORM 1.2 preview available; full package by implementation scope.
From packet to offer
Private offers are generated from readiness packets
A private offer should be generated from a clear packet, not a vague intake thread. Complete the readiness packet for your engagement, then we turn it into a fixed-fee offer.
- 1Choose your buyer pressure
- 2Complete the readiness packet
- 3Confirm NDA / legal path
- 4Generate draft SOW inputs
- 5Request a fixed-fee private offer
- 6Kickoff after approval
Readiness packets
Pick the packet to turn into an offer
Each packet captures scope, authorization, access, evidence, and contracts — everything finance and legal need to approve a fixed-fee engagement.
Launch Review Packet
We are launching an AI feature, copilot, RAG system, agent, or workflow soon and need launch-risk clarity fast.
Required to assemble
Target AI feature or workflow · Lifecycle stage · Release pressure · Architecture overview · Evidence available · NDA/SOW path
Likely blockers
Missing staging/demo access · Unclear system prompt / RAG / tool boundaries · No launch owner · No buyer/security evidence owner
Routes to:
Product Security Packet
We need a full architecture, data-flow, trust-boundary, model/provider, RAG, and tenant-isolation review beyond an urgent launch gate.
Buyer Evidence Packet
Enterprise buyers are asking AI security questions we cannot answer cleanly, and the deal/security review is slowing down.
Required to assemble
The buyer questions / questionnaire · Claims needing support · Existing evidence · Trust-center / audience
Likely blockers
No evidence owner · Claims lack scope / date · Unclear what is public-safe
Routes to:
Agent Authority Packet
Agents, tools, credentials, workflows, approvals, and actions have unclear blast radius.
Required to assemble
Agent / tool inventory · Permissions & credentials model · Approval & rollback paths · Logs / audit coverage
Likely blockers
Unclear tool / action blast radius · No rollback path · Missing audit logs
Routes to:
Pentest Readiness Packet
We need a pentest or adversarial test, but scope, authorization, ROE, access, window, evidence, and procurement are not ready.
Required to assemble
Target inventory · Ownership / authorization · ROE · Testing window · Emergency contact · Access plan · Evidence rules
Likely blockers
Third-party target authorization · No testing window · Missing stop contact · Production constraints unresolved
Routes to:
AI Red Team Packet
We need adversarial validation of prompt injection, RAG exposure, tool abuse, tenant leakage, and unsafe autonomy.
Required to assemble
Model / provider / app surface · Prompt / RAG / tool boundaries · Allowed adversarial methods · Prohibited methods · Evidence handling · Human approval points
Likely blockers
Unclear tenant / data boundaries · No safe test data · Tool / action blast radius unclear
Routes to:
RAG Boundary Packet
RAG retrieval, embeddings, ingestion, and tenant boundaries may leak customer or cross-tenant data.
Required to assemble
Source systems · Corpus sensitivity · Tenant boundaries · Retrieval access rules · Eval / logging coverage
Likely blockers
Unclear source ownership · Production customer data present · No retrieval logs / evals
Routes to:
Connector Security Packet
OAuth apps, SaaS connectors, scopes, webhooks, token storage, and connected actions need a least-privilege review.
Required to assemble
Connected apps · OAuth scopes · Read/write actions · Webhook / callback handling · Token storage assumptions · Revocation path
Likely blockers
Excessive OAuth scopes · Unclear admin ownership · Missing revocation process
Routes to:
Enterprise Onboarding Packet
Enterprise SSO/SCIM, RBAC, provisioning, deprovisioning, and auditability are becoming a deal blocker.
Required to assemble
IdP · SSO protocol · SCIM / provisioning · Role / group mapping · Deprovisioning · Audit / logging needs
Likely blockers
No IdP owner · Unclear role model · No test users / groups
Routes to:
Program Build Packet
AI security is scattered policy with no operating model, ownership, controls, evidence, or cadence.
Maturity Scorecard
We do not yet know our AI security gaps or where to invest first.
Secure AI SDLC Packet
AI security is not operationalized in engineering: CI/CD, design review, code review, evals, logging, and release gates.
Required to assemble
Current SDLC / CI-CD · Release process · Eval / test coverage · Design / code review practice
Likely blockers
No release-gate owner · Eval coverage gaps · No logging baseline
Routes to:
Guardrails & Evals Packet
Our guardrails, evals, refusal behavior, and release criteria have unknown coverage and failure modes.
Provider Risk Packet
We need clarity on model/provider data flows, retention, training terms, residency, logging, and fallback risk.
Required to assemble
Providers in use · Data sent to each · Logging approach · Residency requirements
Likely blockers
No DPA from provider · Unclear retention / training terms · No fallback design
Routes to:
Claim-Readiness Packet
We need to control what we can safely say publicly or to buyers after assessment work.
Required to assemble
Intended claim · Audience · Evidence source · Scope / date / limitations · Approval owner · Public-safe summary needs
Likely blockers
Draft evidence treated as final · Claim lacks scope / date · No approval owner
Routes to:
Custom Support Packet
We have a specialized AI security need that does not fit a standard service.
Engagement readiness
Ready to scope is not the same as authorized to test.
Testing starts only after the required SOW, ROE, target list, access path, and testing window are approved.
Technical Scope
Needs inputTechnical owner or security owner
Inputs: Target systems, lifecycle stage, architecture overview, boundaries
Next: Define the in-scope systems and surfaces
Build a packetLegal / NDA / DPA / SOW
Needs inputLegal owner
Inputs: Mutual NDA, DPA if personal/customer data, SOW or no-cost scoping
Next: Start the no-cost scoping / NDA path
Contract packetAccess & Credentials
Needs inputTechnical owner or IT/admin owner
Inputs: Access model, test accounts, secure credential-delivery channel
Next: Plan secure access — never via public forms
Evidence Handling
Needs inputSecurity owner
Inputs: Storage location, redaction, retention, deletion
Next: Confirm evidence storage + retention rules
Evidence Handling PolicyScheduling & Stop Contacts
Needs inputTechnical owner and emergency contact
Inputs: Testing window, blackout dates, stop-testing/emergency contact
Next: Set the window and a reachable stop contact
Procurement / Payment / Private Offer
Needs inputFinance / procurement owner
Inputs: Vendor packet, budget category, PO/payment path, private offer
Next: Request a fixed-fee private offer once scope is clear
Private offersDo not submit secrets, production credentials, access tokens, regulated data, or unredacted customer records through public forms. Credential exchange happens only after NDA/SOW/DPA/ROE through an approved secure channel.
What you can bundle
One scoped engagement, many components
Products + onboarding
SecEng tools and platforms with implementation and onboarding included.
Services + retests
Assessments, red teaming, and hardening with scheduled retests.
Academy at scale
Team training, SCORM/LMS packages, and certification seats.
Evidence + reporting
Evidence packs, control mappings, and executive reporting cadence.
Enterprise packages
Common starting points
SecEng Workbench
AI security program, trust evidence, and remediation workbench
SecEng Trust Scanner
AI and security claim scanner for customer-facing trust language
SecEng Adversarial Range
Deployable AI security lab for RAG, agents, telemetry, and evidence validation
SecEng Evidence Analytics
Evidence debt, high-risk claim, and AI security analytics for SIEM and BI platforms
SecEng AI Security Program Jumpstart
Expert-led AI security program launch via direct SOW
SecEng Enterprise AI Security Buildout
Full-scope enterprise AI security program design, implementation, and enablement
AIPSA SCORM Training Package
LMS-compatible AI product security training — 16 hands-on labs, SCORM 2004, xAPI, and LTI 1.3
AI Security Workforce Readiness
The workforce intelligence layer for cybersecurity training platforms, cyber ranges, and enterprise security teams. Role taxonomy, Q&A bank, job-market signals, hiring calibration, and workforce reporting — under your brand.
SecEng Scan OEM Pack
White-label AI security scanning for vendors that already own vulnerability management, DAST, API, infrastructure, AppSec, or remediation workflows.
AI Launch Security Review
Pre-launch AI security review for product teams shipping LLM features, RAG systems, copilots, agents, or AI workflows.
Pen Test & Red Team Readiness Packet
Structured readiness assessment for teams scoping an external pen test or red team engagement — scope, authorization, ROE, evidence handling, and vendor criteria.
Academy Enterprise Training Pack
Structured AI security training for security, engineering, product, governance, and trust teams — courses, Q&A checks, LMS delivery, and private cohorts.
Academy White-Label Partner Pack
Partner-ready AI security training content — courses, Q&A bank, LMS packages, and workforce readiness modules for training platforms, cyber ranges, and enterprise L&D delivery.
Request a private offer
Tell us what to scope
This routes directly to our scoping queue. Do not paste secrets or customer data — just enough context to prepare a tailored private offer.
Private-offer packet
The default enterprise packet is ready to assemble.
This packet is designed for quote-first and invoice-first motion with legal, procurement, data handling, and evidence language attached to the same opportunity.
Statement of Work Template
Mission-specific scope, deliverables, timeline, access, assumptions, and acceptance criteria for scoped AI security engagements.
Mutual NDA
Mutual confidentiality protections for pre-sales, delivery, and research collaboration contexts.
Used for NDA baseline
Assessment Terms Addendum
Scope, authorization, evidence use, testing boundaries, safe harbor, retesting, reporting limitations, and reliance limits for AI product security assessments.
Used for Assessment and quote-first services
Data Processing Addendum
Controller/processor allocation, data protection obligations, subprocessing, security measures, AI provider boundaries, and customer-data handling for scoped services.
Used for Data handling and public-safe claims
Commercial Services Addendum
Converts the services framework into scoped paid work with rate card, invoicing, and activation terms.
Used for Retainer and advisory billing
Publication & Claim-Readiness Policy
Claim-readiness criteria for public research, trust pages, scorecards, attestations, sponsor materials, security review outputs, and buyer-facing evidence.
Used for Data handling and public-safe claims · Sponsored research and launch
Payment terms
Net 30, prepaid invoice, or custom procurement terms.
Acceptance terms
Accepted when the agreed deliverables are delivered and the buyer has had a factual review window.
Fulfillment workflow
scope -> packet -> quote / invoice -> acceptance -> launch room
Prefer to browse first? Back to the Marketplace