PinkCloudStart a conversation

What we do

Three practices, one team

Each is scoped and priced on its own. They are staffed by the same small group of people, which is why findings from one routinely change the recommendation in another.

Break it

AI Security

Adversarial assessment of language models and the agentic systems built on them — prompt injection, tool-use abuse, data exfiltration, alignment failure under pressure.

from $14,000Pricing status: confirmed. PinkCloud quotes from these figures.Explore AI Security →

Run it

Cloud Engineering

DevOps and FinOps for teams whose infrastructure bill grew faster than their traffic. Cost attribution, performance engineering, and platform reliability with measurable outcomes.

from $12,000Pricing status: confirmed. PinkCloud quotes from these figures.Explore Cloud Engineering →

Build it

AI Engineering

Inference infrastructure, retrieval pipelines, agent orchestration, and the evaluation harnesses that tell you whether any of it actually works.

from $16,000Pricing status: confirmed. PinkCloud quotes from these figures.Explore AI Engineering →

Each floor is an hour budget at $100/hour, and it is a floor: while we are scoping, more systems, an expedited start or compliance evidence quote above it; once you have signed, the fee and the window hold. The Exposure Review below is the exception — fixed scope, no uplift. Prices exclude any applicable tax.

Start small

Exposure Review

A fixed-scope first look, sized so it can be approved without a procurement cycle. We map the input surface, the tool permissions, and the cost concentrations, then hand you a prioritised list of what we would fix and what it would take.

It exists because the first conversation is usually the expensive one. Nobody wants to commit to a six-week engagement to find out whether there is a problem worth six weeks. This is sized to be approved on a corporate card rather than through procurement, and it either produces a shortlist worth acting on or it tells you your exposure is smaller than you feared.

If it turns into a larger engagement, the fee comes off the first invoice. If it does not, you still keep the findings.

entry

A fixed-scope first look in five days: we map the input surface, the tool permissions and the cost concentrations, then hand you a prioritised list of what we would fix and what it would take.

$4,500

5 days · fixed scope

45 hours at $100/hour

Pricing status: confirmed. PinkCloud quotes from these figures.

Prices exclude any applicable tax.

Deliverables

  • Input-surface and tool-permission map
  • Top exposures, ranked by exploitability
  • Cost concentrations and quick wins
  • A costed shortlist of what we would fix

Deliverables

  • Input-surface and tool-permission map
  • Top exposures, ranked by exploitability
  • Cost concentrations and quick wins
  • A costed shortlist of what we would fix

Exclusions

  • A compliance certificate or an audit opinion: if the goal is a certificate for a customer questionnaire and nobody intends to act on the findings, a larger firm with an audit practice will serve you better and cost less
  • Staff augmentation: this is fixed-scope work with an end date, not two engineers embedded for six months
  • Adversarial testing of a system that is not built yet: testing needs something to test, and at the whiteboard the useful conversation is an architecture review
  • Incident response and on-call cover: we are not an incident-response retainer and we do not carry a pager
  • Compliance evidence deliverables: these normally add 10 percent to the floor, but the entry fee here is fixed and no uplift applies
  • On-site attendance: delivery is remote by default, and on-site work needs a scoping call
  • Doing the remediation: the review hands over a costed shortlist of what we would fix, and the work itself is a larger engagement
  • None of the above is a refusal: everything here has a route and a rate. Work outside this scope is quoted at our published hourly rate — as a change request or as a separate engagement, agreed in writing before it starts. The review itself stays fixed: 45 hours at that rate, and no uplift applies
Order

How we engage

Fixed-fee and fixed-window. Every engagement has a written deliverable and an end date agreed before it starts. We do not hold findings back to seed a follow-on sale, we do not take a percentage of savings, and we hold no reseller margin on any platform we might recommend.

We are a small team by choice. That means we occasionally turn work down or schedule it out — we would rather tell you that than staff an engagement thin.

Save yourself a call

When we are not the right people.

We would rather you worked this out here than three weeks into a procurement process. If you recognise your situation below, we are probably not your best option — and where we can, we will point you at someone who is.

  • You need a compliance checkbox, not an assessment

    If the goal is a certificate for a customer questionnaire and nobody intends to act on the findings, a larger firm with an audit practice will serve you better and cost less.

  • You want staff augmentation

    We do fixed-scope engagements with an end date. If what you actually need is two engineers embedded for six months, that is a hire, and we will say so.

  • The system is not built yet

    Adversarial testing needs something to test. If you are at the whiteboard, the useful conversation is an architecture review — that is AI Engineering, not AI Security.

  • You need someone on call

    We are not an incident-response retainer and we do not carry a pager. If you are mid-incident right now, you need an IR firm today and us afterwards.

None of those? Start a conversation