The Engagement
August 2026
What actually happens, what it produces, roughly what it costs, and the limits written down before signature rather than discovered afterwards. The limits are the longest section, and that is deliberate.
Most of the value here is in what this declines to promise.
Two things are sold
A measurement, and an accountability
They are separate, they are bought in that order by almost everyone, and the first frequently concludes that the second is not needed yet. That is a legitimate outcome and it happens often enough to be worth saying before you pay for anything.
Fixed fee, fixed window. An evidence-based score against a published rubric, a permission and blast-radius map, and a dated gap register. It ends with a document.
Monthly. A named individual accountable for AI security, with the authority to halt a deployment. It ends when somebody says so, in writing.
The assessment
Four depths, and the difference is scope rather than standard
The criteria, the evidence gate, the floor rule and the arithmetic are identical at every depth and for every size of client. What changes is how much estate is covered, how much evidence is gathered, and what level can honestly be certified.
| Depth | Window | Indicative | What it is for |
|---|---|---|---|
| Rapid | ~1 week | $9K to $12K | An eight-dimension scan and the top five gaps. Cannot certify L2 or above, and the ceiling is stated in the proposal rather than only in the report |
| Standard | ~4 weeks | $18K to $28K | The default. Full instrument, direct evidence collection, blast-radius map, prioritised roadmap |
| Standard, narrow | 1 to 2 weeks | $12K to $16K | A small estate at full depth. Every credentialed agent, L2 certifiable. Cheaper because there is genuinely less of it, not because the bar moved |
| Deep | 8 to 12 weeks | $35K to $60K | Adds threat modelling, adversarial validation, full architecture review and a board-ready report |
Fees are indicative and quoted against scope. Forty per cent is invoiced on countersignature, because an assessment is almost entirely front-loaded effort and a deposit is the cheapest way for both parties to find out whether the budget actually exists.
What happens, week by week
Intake, rules of engagement, evidence collection
What is in scope, what access is granted, who may be interviewed and what may be touched. The rules of engagement are signed before anything is looked at. Most of the week is spent gathering directly observable evidence rather than asking people to describe their systems.
Inventory and blast-radius mapping
Every agent holding a credential, what it can reach, and what is downstream if it is wrong. The inventory almost always ends larger than the one you started with, and the delta is itself a finding.
Scoring and the gap register
Adjudication criterion by criterion, each with a verdict, an evidence grade and a citation. Every unmet criterion becomes exactly one gap row. No bundling, so the register is mechanically re-derivable next quarter and the movement between the two is real.
Report, readout, handover
Written for a reader who was not in the room: an auditor, an insurer, an acquirer, a customer's security reviewer. If only the sponsor can use it, it is a deck.
What you are left holding
- The scorecard. Eight dimensions, the floor named, every criterion with its verdict, grade and citation.
- The permission and blast-radius map. The artifact most likely to be forwarded to a CISO or an insurer, which is why it is written for them.
- The gap register. One dated row per unmet criterion, with an owner field that is yours to fill.
- The roadmap. Sequenced by what actually moves the floor, which is frequently not the work that feels most urgent.
- The report. Complete with scope, method, rubric version and limitations. Provide it onward complete; extracts change what it says.
The officer retainer
A named individual, accountable, with authority to stop something
Sold by the month against a defined number of days, not by the hour. An accountability billed in six-minute increments is not an accountability, it is a consultancy with a serious-sounding title.
| Tier | Days per month | Indicative | Shape |
|---|---|---|---|
| Advisory | 1 to 2 | $6K to $9K | Cadence, review, and the named appointment. Not enough time to run a programme |
| Operational | 4 to 6 | $12K to $18K | The common shape. Governs an assessment cadence and a live gap register |
| Embedded | ~10 | $20K to $28K | Half time. Appropriate where AI is on the critical path of the product |
The premium narrows as the tier grows, deliberately. At Advisory you are buying judgement and artifacts. At Embedded you are increasingly buying time, and time commoditises faster than capability. A rate defended on hours is a rate that loses an argument with procurement, so it is not defended that way.
The limits
Stated here because a buyer should read them before a call, not during one
Every item below is a real constraint on what is being sold. A provider unwilling to put its equivalents in writing has told you which of its two lists is longer.
Business hours. Not a pager, and not monitoring.
Acknowledgement within two business hours during standard hours, next business day outside them. Saluca does not watch your estate. The officer acts on what is escalated or observed in the agreed cadence, not on continuous surveillance, and there is no guaranteed out-of-hours response. Where an organisation genuinely needs 24/7 cover it needs a different arrangement, staffed before it is sold.
There is no independent reviewer check
The methodology calls for a second assessor to re-score the floor dimension and every criterion met at L2 or above. Saluca does not currently resource one, so that check is not performed. It is stated in the statement of work before signature and again as a limitation in every report. The compensating controls are real but partial: the evidence gate is enforced in code rather than by discipline, and every criterion carries a citation.
No named alternate at present
One person can perform the officer function today. This is disclosed before signature, and the client holds a right to terminate immediately if that individual becomes unavailable beyond a stated period with no agreed substitute. Giving the client that right is not a concession; its absence is what would make the arrangement look like keeping a fee while a function lapses.
Four concurrent retainers, at most two above Advisory, one assessment at a time
Days per month divided by days per engagement, and no more optimistic than that division allows. The number is published so it can be held to, and so a prospect can tell whether the answer they are given has been adjusted to fit their deal.
Work Saluca built is not graded by Saluca alone
Where an assessment covers a control Saluca designed or installed, the finding carries an express independence caveat, the adequacy decision is the client's, and the finding goes to an unaffiliated reviewer. Any commercial interest in a recommended remediation is disclosed before the recommendation, not after you have acted on it.
What this is not
Plainly, and in the contract as well as here
- Not a certification or an attestation. No standards body has authorised anyone here to grant one, and a crosswalk in a report is a mapping rather than evidence of conformity.
- Not an audit within the meaning of any professional standard, and not a penetration test.
- Not legal advice, and not a substitute for counsel on any regulatory question the assessment surfaces.
- Not a warranty that your systems are secure. The obligation is diligence and execution of a defined process, not an outcome. Whether that standard was met is assessed against what the engagement required and the evidence available in scope, not against whether an incident later occurred.
- Not a guarantee that every deficiency was found. Scope, access and the evidence window bound the findings, and the report states those bounds.
Starting
A conversation, and an honest answer about whether you need this
The useful first call is short and has one question in it: how many of your AI systems hold credentials that let them change something, and who approved the last one? A prospect who knows both numbers has governance already and probably needs a re-score rather than an assessment. A prospect who knows neither has the problem and now has it in their own words.
If a Rapid scan is the right answer, that will be the recommendation. If nothing is the right answer, that will be the recommendation. The assessment qualifies the retainer, and a retainer sold before anyone has seen a gap register is the fragile version of this business.
What an accountable AI security officer is, and what breaks in an estate without one.
Eight dimensions, four levels, the evidence gate and the floor rule, with the arithmetic shown.