Detection and response
$2,500/mo plus $25 per user
Extended coverage with severity-1 page-out, threat hunting, threat-intelligence enrichment, incident response run, and forensics readiness.
The operated partnership
We run the function. You watch it run.
The operated partnership hands your IT, security, and compliance to Cloud Sentry on one flat monthly retainer. Named specialists work inside the same portal your team signs into, so you can watch everything we do. Published pricing lives on the plans page; this page is how the whole thing is built.
The shape of the deal
Every line below appears in the agreement you sign.
- Retainer
- One flat monthly fee
- Structure
- Base operations fee plus a per-user rate
- Term
- 3 years, multi-year options
- Growth billing
- Quarterly true-forward
- Annual increases
- Capped in writing
- Specialists
- Named, working in your portal
- Severity-1
- Page-out response, 24/7
Comparing routes? The published tiers live under See plans.
The scope
What we run for you
One function absorbs the queue, the identities, the risks, and the evidence; one team runs it. What follows is the standing scope of every operated partnership, and every item on it is included from the start.
IT and service deskbase
The queue your company feels every day. Requests and incidents worked by named specialists, each with an SLA clock your team can watch.
Access lifecyclebase
Joiners, movers, and leavers handled the day they happen. Every grant is requested, approved, and evidenced in one place.
Risk registerbase
A live register with owners and review dates. Your admins propose entries, and a specialist confirms each one before it stands.
Evidencebase
Control evidence collected on a calendar and kept current in the vault, ready for the next audit or the next customer review.
Security operationsnamed module
Endpoints and identity watched under the detection and response module, with extended coverage and severity-1 page-out. Staffed around-the-clock eyes-on-glass is a separately priced enterprise uplift.
Compliance operationsnamed module
Framework programs run end to end under the compliance operations module: control calendar, evidence collection, and audit management.
The market math on the tool stack a function like this replaces lives on its own page, with a source and a date on every line. Read the math on the stack
Priced on their own line
What each module costs
Modules attach to the partnership and to the enterprise deployment. They price the same way the tiers do, and every price here is published on this page.
Compliance operations
$2,000/mo plus $20 per user
The compliance function run as a service beyond the Assurance tier: framework program management, evidence operations, and questionnaire response at depth.
Executive advisory
Three bands
Fractional leadership in three bands. This is how a CISO, CIO, CTO, or CAIO arrives in the structure, and AI governance oversight is included in the same line.
- Advisory$2,500/mo
- A quarterly review, and on call for the decisions that need a name behind them.
- Engaged$5,500/mo
- A monthly cadence, plus board and customer-facing representation when you need it.
- Embedded$9,500/mo
- A weekly cadence with a named executive who sits in your leadership meetings.
Visibility
What your team sees
A function we run is still your function. Your team keeps a live view of everything we do, in the same portal our specialists work from, for the life of the contract.
An illustrative sketch. The live portal, with real anonymized views, is on the platform page.
- RequestsEvery open item, who owns it, and the SLA clock running against it, all in view.
- Risk registerA live register with specialist review. Your admins propose entries, and a specialist confirms or declines each one.
- Evidence vaultThe control evidence library, current and exportable, with time-bounded guest access for your auditor.
- Retainer burnWhere the month went, itemized in minutes against the flat fee. You see burn exactly the way we see it.
- CoverageWho is on shift and when, published in the portal, so you can check severity coverage on any day of the term.
How the agreement works
Built to be operated for the long run
The commercial shape is summarized in the term sheet above, and the published pricing lives on the plans page. How the agreement itself is put together, so you know every term before the order form arrives.
01
3-year terms
Running a function well takes tenure, and the term is built for it. Multi-year options extend the same structure, cap included.
02
Quarterly true-forward
Headcount is counted at each quarter's close. Growth bills forward from the next quarter, and every quarter already billed stays exactly as it was.
03
A written escalator cap
The maximum annual increase is a number printed in your agreement, fixed before you sign. You know the ceiling on renewal pricing going in.
04
One-time implementation
A single implementation fee stands the function up: inventory, portal rollout, and the scoped first quarter you can read about below.
The bar under all of this is the same one under every Cloud Sentry plan: the platform, named specialists, published flat pricing, and a written escalator cap. The partnership is simply the largest thing built on it.
Where our work ends
The specialists we hand you to, and what they cover
A partnership works when the boundaries are written down. These are the engagements that belong with another trade, and who we bring in for each.
- Penetration testing and red team. We read configuration. When you need a test, we scope it with a named testing partner and sit on your side of the table.
- Deep digital forensics. We keep you forensics-ready with retention, preservation, and response. Full DFIR beyond that goes to a named partner or scoped time and materials.
- Crisis communications. Breach PR and notification strategy belong with counsel and communications specialists. We support them with the technical record.
- Privacy counsel. We prepare the evidence and the posture; legal advice comes from lawyers.
- The audit itself. We get you ready and hand your auditor a clean vault. Independent firms certify; the grading stays with them.
- Physical security. Badges, cameras, and doors are a different trade. We will say so, and point you to one.
Where it runs
Run it hosted, or self-hosted in your own cloud
Standard delivery is the hosted platform: we run it, patch it, and answer for it. When residency or procurement rules out shared infrastructure, the same platform is self-hosted, deployed single-tenant inside a cloud account you already own, AWS included. You keep the boundary; we keep the upgrade path, the patching, and 24/7 severity-1 page-out response.
- Your account, your region, your keys. The platform stands up single-tenant inside a cloud account you already govern, AWS included, and your security team can audit the deployment directly.
- Built for the deals that demand it. Data-residency clauses, regulated buyers, and security teams that require dedicated infrastructure. Self-hosted single-tenant answers all three while the function runs exactly as it does elsewhere.
- Single-tenant stays on the current version. Your deployment rides the same release train as the hosted platform, on a cadence written into the engagement.
- Coverage is identical. The operating team, the SLA clocks, and severity-1 response work the same way they do on hosted delivery.
A three-year engagement, from $100,000 a year, running in a cloud account you own and can grant us access to. Our operators work in that account, and our team runs the platform there for the whole term. We confirm that shape with you on the first call.
The engagement
How the engagement runs
Every partnership starts the same way and settles into the same rhythm. We tell you what we see on the first call, including whether the partnership is the wrong shape for you.
01
The discovery call
Fifteen minutes with an operations lead. We walk your current stack, size the user band from your real headcount, confirm BYOC qualification if you need it, and give you a plain read on fit.
- Current stack walked end to end
- User band sized from real headcount
- BYOC qualification confirmed if needed
- A plain yes or no on fit
02
The first quarter, scoped
Implementation runs as a scoped quarter with named owners and dates. Your specialists are introduced by name, the portal goes live for your whole company, and the SLA clocks start where everyone can see them.
- Named specialists introduced before work begins
- Systems and access inventoried and documented
- Portal live for your whole company
- SLA clocks running from the first ticket
03
The operating rhythm
From the second quarter the partnership is a cadence. The queue is worked daily, evidence is collected on the calendar, and each quarter closes with a written review carrying the numbers behind every claim we make about our own performance.
- Daily: the queue, access work, and the monitoring your modules cover
- Monthly: retainer burn reviewed in the portal, in minutes
- Quarterly: the written review, the true-forward count, and the road ahead
Scope it in one call.
Fifteen minutes with an operations lead. We walk your stack, size the user band, and tell you plainly if the partnership is the wrong shape for you.
Bring your renewal invoices and your headcount. We put real numbers into the structure on this page before anything gets signed.
Prefer to start smaller? The published tiers use the same grammar, a base operations fee plus a per-user rate, and the entry rung self-enrolls.