Watch
$720 / month
- ✓ Named responder on 24/7 recall
- ✓ Priority triage within four hours
- ✓ Annual security posture review
- ✓ Cyber-insurance documentation support
The engagement catalogue · Milton, NH
The full range of defensive work, priced in the open.
Every Kryptomend engagement is fixed in scope and stated in price before it begins. What follows is the whole catalogue — from a single penetration test to a firm kept on standing recall.
Jump to it
At a glance
- Penetration testingFrom $5,200
- Audits & reviewsFrom $2,600
- Standing retainersFrom $1,150/mo
- Incident responseOn call
How every service is delivered
One discipline runs beneath all of it.
Whichever line you engage, the method is the same: a written scope, real-world testing, a report your own team can act on, and a retest to prove the fix. No line item is a black box.
- AWritten before we begin
Rules of engagement, systems in scope, and test windows are signed off — so you always know what is happening and when.
- BTested the way an adversary would
Manual exploitation, not just an automated scan — credential attacks, misconfigurations, and known ransomware footholds.
- CReported in plain language
Each finding is ranked by exploitability and business impact, with reproduction steps and a remediation path.
- DProven closed
Critical and high items are retested at no extra charge to confirm the door is actually shut.
Kept on standing recall
Three depths of ongoing cover.
Most clients begin with a fixed-scope engagement and move to a retainer once they see the surface they were carrying. Choose the depth that fits your risk.
Standing retainer
$1,150 / month
- ✓ Named responder on 24/7 recall
- ✓ First response within the hour
- ✓ Quarterly re-testing of key surface
- ✓ Annual full penetration test included
- ✓ Insurance & compliance documentation
Virtual CISO
From $2,200 / month
- ✓ Everything in the standing retainer
- ✓ A named security lead on your leadership calls
- ✓ Board-ready reporting & roadmap ownership
- ✓ Vendor & contract security review
Before you engage
The questions we're asked most.
Straight answers on scope, price, and what a test does to a business that has never had one.
Will testing take our systems down?
No. Every engagement runs inside agreed test windows with rules of engagement signed in advance. We flag any high-risk action before it runs, and destructive testing is never performed without explicit, written consent for that specific step.
We're only fourteen people. Are we too small?
A breach checks whether the door was locked, not the size of the payroll. The bulk of ransomware losses land on businesses under a hundred staff. Our fixed-scope assessments are built for exactly that size — a clear starting price and a report your existing IT support can act on.
How is the final price set?
The figures on this page are typical starting points. We hold a short scoping call, count the systems genuinely in play, and quote a fixed price before any work begins. You are never billed for hours spent scanning systems that were never in scope.
What do we actually receive at the end?
A findings report led by a plain-language executive summary, then every issue ranked by exploitability and business impact with reproduction steps and a remediation path. It maps to the questions on common cyber-liability questionnaires, and includes one retest of critical and high items.
How quickly can you start — and how long does it take?
Scoping is typically a one-week intake. A fixed-scope assessment is delivered in three to four weeks, with the findings report inside ten business days of testing. An active incident is different — for that, call the line, don't wait on a form.
What happens to our data and findings afterward?
A mutual NDA precedes every engagement. Test data, credentials, and findings are held under a documented retention and destruction policy and removed on the agreed schedule once the work closes.
Not sure which line you need?
Most engagements start with one scoping call.
Tell us what you run and who you answer to. We'll point you at the right first step and quote it in writing — no obligation to go further.