Bespoke engagement
Evidence Gathering
I collect the proof your security claims rest on.
Scoped per engagement
A report tells you where the gaps are. Auditors, buyers and notified bodies ask the harder question: show me the evidence behind each answer.
Gather is the engagement where I collect that proof. I work through your firmware, build system and supply chain and come out with the raw material a technical file is built from — a threat model derived from the code rather than a template, an SBOM with the known vulnerabilities triaged, and an inventory that maps each CRA and PSTI claim to the artifact that proves it.
What it covers
- Threat model built from the firmware, not a template
- SBOM with known-vulnerability triage
- Evidence inventory mapped claim-by-claim to CRA / PSTI
- Gap register with named owners
Worth scoping if
- A review (ours or your own) named the gaps, and now you need the substance behind the answers.
- A buyer or auditor has moved from “do you?” to “show me”.
- Several SKUs share a platform and nobody is sure which evidence covers which product.
How it works
-
Scoping call
I size the estate — products, firmware images, build systems — and put a fixed quote in writing.
-
Access and interviews
NDA first, then repository access and structured sessions with the engineers who know the code.
-
Investigation and capture
I build the threat model from the firmware, generate and triage the SBOM, and trace every claim to its artifact.
-
Handover
An evidence pack your team owns, a gap register with named owners, and a readout that walks both.
Asked before scoping
-
Why is there no price on this page?
Because the honest answer is “it depends on your estate”. One product with one firmware image is a different engagement from five SKUs on a shared platform. You get a fixed written quote after a twenty-minute scoping call — no rate cards, no surprises mid-engagement.
-
How is this different from the Readiness Review?
The Review diagnoses — it tells you where you stand and what to fix first. Gather substantiates — it produces the evidence a third party will ask to see. The ladder is built to run the Review first, then scope Gather against its findings.
Scope it against your estate
A twenty-minute call is enough to size the engagement and put a fixed quote in writing.
Field notes
Join the list
One field — your work email. One email every two weeks.