Securing today.
Protecting tomorrow.

There is no list price, because there is no standard company. We scope on one short call and send a fixed price before any work starts — no hourly surprises, no line items you didn't agree to. If the number doesn't fit your budget, say so: we will tell you honestly what we can cover for the money you have and what should wait for the next round.

From the size of the company and the shape of the infrastructure, not from a rate card. What we count: how many applications, APIs and external hosts are in scope, whether internal network or Active Directory is included, how many user roles and integrations need to be tested, whether cloud and mobile are in play, and how deep you want us to go. A ten-person SaaS with one product and a bank with thirty systems are different jobs — and different prices.

It depends entirely on your requirements. A focused web or API test is usually one to two weeks of testing plus a few days for the report. Full external plus internal scope, an AD environment, several products or a red-team engagement with social engineering can run several weeks to a couple of months. You get the schedule in writing at the scoping stage, and critical findings reach you the same day we confirm them — you never wait for the final document to start fixing.

Yes — that is the reason Hexarion exists. Security shouldn't be a privilege of companies with a dedicated department and a seven-figure budget. We scope to what you can afford, start where the real risk is, and grow the programme as you grow. A startup can begin with one focused test and a short vCISO engagement, and add monitoring and compliance later, when it actually needs them.

Every client gets a personal Hexarion cabinet, and everything lives there: licenses, reports, security metrics and your Security 360 plan. No chasing attachments through e-mail, no bureaucracy, no "which version of the PDF is current?". Findings appear in the cabinet as we confirm them, the report lands there when it's ready, and your team sees the same picture we do. Urgent things still reach you instantly through the channel you prefer — the cabinet is the record, not a queue.

A technical report with reproduction steps and evidence for the engineers; a business-level summary for management; a prioritized remediation plan with effort and impact; and, after your team ships the fixes, a retest with a letter you can hand to clients, partners or auditors. Everything is in your cabinet, and everything stays there — you keep the history, not just the last file.

Both sides. Auditors and engineers get what they need — controls, evidence, reproduction steps. But the part most vendors skip is the business one: what this finding actually means for your revenue, your customers and your obligations, why it matters, and what happens if it stays open. Our reports are written so a founder or a board member can read them and make a decision, without translating from security jargon first.

A full-time CISO is a senior salary, months of hiring, and one person's experience. A virtual CISO gives you the same function as a service: we own security strategy and priorities, write and maintain policies, handle security questionnaires from your clients, run vendor reviews, prepare you for audits and drive fixes to closure. You get a team's experience across many companies instead of one CV, at a fraction of the cost, and you can scale the engagement up before an audit and down afterwards. Everything we do is visible to you in the cabinet, so the work is a plan with evidence — not a monthly invoice and a slide deck.

With Obrenix, our own GRC platform. It keeps a live controls register across ISO/IEC 27001:2022, DORA, NIST SP 800-53 rev5, NIS2, OWASP ASVS, SOC 2, GDPR, NIST CSF 2.0, ISO/IEC 27002:2022 and CIS Controls v8.1, with AI cross-mapping — close a control once and see where it lands in every other framework. Owners, evidence, gaps and audit-ready reports are in one console, self-hosted inside your network. Audits stop being an archaeology project.

That's IRIS, our AI-native SecOps platform. It ingests events from the sources you already run, triages and correlates them automatically, and hands your team cases with context and recommended actions instead of a wall of raw alerts — plus proactive threat hunting and live user-behaviour analytics. A small team gets the reach of a much larger SOC, and it runs inside your perimeter.