Security advisor on retainer: a pentester who stays involved
You don't have a security specialist of your own, but the questions keep coming. A customer sends a security questionnaire, a vendor wants access to your systems, your team is building something new. As your security advisor on retainer, I'm the person you go to. You start with a security roadmap, then have fixed hours every month for advice, and if you want, a day of testing or on-site advice.
For organisations without their own security specialist.
A full-time security officer is often a step too far. Hiring a large consultancy for one-off questions is expensive and slow. This sits in between: one dedicated specialist who knows your organisation, and who does the testing too, instead of only writing policy. It fits if:
- customers or partners send you security questionnaires and you want to answer them well and honestly;
- NIS2 applies to you, or to your customers, and you want to know what that means for you;
- your team builds or buys new systems and wants to know where the risks are up front;
- you've had a pentest and want the findings to actually be followed up.
Advice from someone who attacks for a living.
Questions by email
Ask whenever a question comes up. You get an answer within one business day, from me personally.
Monthly check-in
A fixed moment each month to go through the roadmap: what's done, what's slipping, what's new.
Questionnaires and vendors
Help with your customers' security questionnaires, and with assessing vendors and their answers.
Design input
A sparring partner on architecture, login flows, permissions and your cloud setup, before it's built. That's cheaper than fixing it afterwards.
The difference from a regular advisor: I'm a pentester. You can also spend the hours on targeted testing, for example of a new feature or of a finding that has been fixed. Advice and verification come from the same person.
Start with a roadmap, continue if it fits.
Security roadmap
- A 2-hour kick-off session with the people who know your systems
- Review of your architecture, cloud setup and latest pentest report
- A written 12-month roadmap, ordered by risk
- A 60-minute walkthrough of the roadmap
The fixed start of every subscription, and also available on its own. Subscribe within 30 days and you don't pay for the roadmap again.
Basic
- 8 hours of remote advice per month
- Questions by email, answered within one business day
- Monthly check-in on the roadmap
- Customer questionnaires and vendor reviews
- Input on design and architecture
For organisations that mainly need a go-to expert and a clear direction.
Plus
- Everything in Basic
- One day a month of manual testing or on-site advice, your choice
- A testing day produces a short findings note
- I check the fixes in the following month's hours
- On-site in the Netherlands, travel included
For organisations that build their own software and want something tested regularly.
3-month minimum, then cancellable monthly with one month's notice. Pay a year in advance and you pay for 11 months instead of 12. Need more, for example several days a month? Then I'll make you a custom offer. On-site work outside the Netherlands is possible by arrangement.
Fixed hours, no surprises.
- Roll-over: hours you don't use roll over one month. After that they lapse. The same goes for the day in Plus.
- Extra work: if something needs more than your hours, you hear so up front, with a fixed price. I only start once you agree.
- Quick answers: I respond to your questions within one business day.
- Priority: if you need a pentest, you get priority in the schedule.
- A limited number of clients: I work with a limited number of retainer clients, so there is real time for each of them.
A testing day in Plus produces a short note: what I found and what you can do about it. It is not a signed report. If you need evidence for a customer, auditor or regulator, a Security Quick Scan or a penetration test is the right choice.
Clear about the limits.
- No 24/7 monitoring or incident hotline. For an acute incident you need an incident response provider. I do help with preparation and follow-up.
- No ISO 27001 certification project. I help with the technical side, but I don't write a complete management system or guide you through certification.
- No legal advice. For contracts and the GDPR, a lawyer is the better choice.
- No transfer of responsibility. Under NIS2, management stays accountable. I advise, you decide.
What you will want to know first.
Is this the same as a virtual CISO (vCISO)?
It's close. A virtual CISO is an external security officer who helps with policy and risk on a part-time basis. The difference: I'm a pentester. You can also spend the hours on testing, and my advice comes from what I find when I attack systems myself. If you mainly need someone to build a complete management system for a certification, a specialised firm is a better fit.
Can I buy just the security roadmap?
Yes. The roadmap is available on its own for €1,500 excl. VAT. You get a written 12-month plan that your own team or another party can carry out. If you subscribe within 30 days, you don't pay for the roadmap again.
Why does a subscription start with a roadmap?
Without a roadmap, the hours go to loose questions with no direction. With one, we both know the biggest risks and what gets worked on each month. And by the time your first question comes in, I already know your environment.
What if I don't use all my hours?
Hours you don't use roll over one month. After that they lapse. The same goes for the testing or on-site day in Plus. If you consistently don't use Plus, you can move back to Basic.
How long am I committed?
At least 3 months. After that the subscription is cancellable monthly with one month's notice. Pay a year in advance and you pay for 11 months instead of 12.
Do I get a pentest report from a testing day?
No. A testing day in Plus produces a short note with the findings and what you can do about them. I check the fixes in the following month's hours. If you need a signed report as evidence for a customer, auditor or regulator, you book a Security Quick Scan or a penetration test. As a retainer client you get priority in the schedule.
Are you independent?
Yes. I don't sell software, licences or managed services. If I recommend a product or vendor, it's because it fits your situation.
What if we have an incident?
I'm not an incident hotline and can't promise to be available at any moment. So make sure you have an incident response provider, for example through your IT supplier. With your hours I do help you prepare: who calls whom, and what you do in the first hour. After an incident, I help with the follow-up.
Do you work on-site?
Yes, in Plus you can also use the monthly day for on-site advice, for example a session with your development team or with management. Within the Netherlands, travel is included. On-site work abroad is possible by arrangement.
Is a security advisor right for you?
In a free 30-minute intake we look at where you stand, and whether a roadmap, a subscription or a one-off test gives you the most.
Request free intake → See the prices