Bespoke engagement
Evidence Retainer
A named engineer, reachable when the clock is 24 hours.
From £3,200
+ VAT · per month · 6-month minimum
· Ongoing · 6-month minimum
From 11 September 2026 you have 24 hours to report an actively exploited vulnerability, 72 hours to follow up, and 14 days to file the final report. No one-off engagement can meet that. A 24-hour window is not a document problem — it needs the components monitored, the advisory triaged, and a named person reachable on the day it lands.
That is what this is. A named engineer who already knows your product watches the dependencies you ship, triages what comes in and tells you whether it is reportable, keeps the evidence tied to each release, and answers the security questionnaires your customers send — so the file your buyer opens describes the firmware you actually ship.
What it covers
- Component monitoring against advisories, so a report is detectable
- Vulnerability triage and the Article 14 24/72/14-day reporting path
- Release-tied technical-file updates
- Quarterly review with a written readout
- Customer security-questionnaire support
Worth sizing if
- You cannot currently name the person who would file an Article 14 report, or the hour it would be filed by.
- You ship components you do not monitor, which means an exploited vulnerability reaches you via the news.
- The technical file exists and now has to stay true through monthly or quarterly releases.
- Customer security questionnaires keep landing and keep stealing engineering days.
- You have no dedicated product-security function and do not want to hire one yet.
How it works
-
Sizing call
Sized on release cadence and product-line count, quoted monthly in writing. Six-month minimum.
-
Onboarding
I absorb the current file and release process so updates start from real context.
-
Steady state
Release-tied updates, a quarterly review with written readout, and a named engineer your team can actually reach.
Asked before sizing
-
Why a six-month minimum?
Anything shorter does not cover a meaningful release cycle — you would be paying for onboarding, not maintenance. Six months is the shortest window in which the retainer can prove its worth.
-
How is it sized?
On release cadence and the number of product lines sharing the file. Quoted as a flat monthly figure in writing — it only changes if your estate does.
Size the retainer
A short call covers release cadence and estate; the quote follows in writing.
Field notes
Join the list
One field — your work email. One email every two weeks.