Skip to content
RockPointCyber

Engagements

Most of this work does not need a new pipeline.

Every engagement below runs on the estate you already have and ends with an artifact you can take to a board, a customer or an underwriter. Ten of the twelve are projects that finish inside a quarter on a fixed fee; two are retainers that provide continuing support. No discovery phase you pay for twice. No transformation to fund before anything improves — if one follows, it follows because the findings justified it.

Twelve of them. Each states its shape, the budget it comes out of — half are not funded from the security tooling line at all — and the edge where its scope stops.

Why now

Seven reasons people call, and what is behind each.

The work that answers them

  • The CRA clock is running

    The regulation reaches manufacturers placing products with digital elements on the EU market, including US companies selling through a distributor. Which of your products it covers, and which obligations apply, is a determination most have not made.

    Reporting obligations apply from 11 September 2026 · main obligations from 11 December 2027

  • Your customers are asking first

    Enterprise buyers and regulators now require SBOMs, provenance and SSDF or CMMC evidence from suppliers. The questionnaire arrives attached to a contract that is otherwise ready to sign.

    The demand lands hardest on mid-size vendors and defense subcontractors, who are least equipped to answer it

  • Underwriters price what they can see

    Insurers increasingly ask for SBOMs and supply chain controls before issuing or renewing, and price vendor risk into the premium. The conversation belongs to the CFO as much as the CISO.

    Justified against premium exposure and renewal risk, not against a tooling budget

  • The window has closed

    Attacker tooling now moves at machine speed through exactly the paths developers trust. Leadership asks one question when an advisory lands, and it is not a tooling question.

    The axios, GhostAction and LiteLLM compromises all share one shape: "are we affected?" with no fast way to answer

  • The worst cases had no CVE

    Compromised maintainer accounts, OAuth applications, reseller channels and retagged actions produce nothing for a scanner to match. Companies that only scan are discovering what that leaves uncovered.

    33 of the 44 supply chain incidents we model had no CVE ever assigned

  • Nobody can defend the tool spend

    Fifteen to thirty overlapping tools with tangled licensing, in a year when every line is being questioned. The easiest security sale in a flat budget is the one that removes spend.

    On the SAST program we model, the license is 34% to 41% of what the tool actually costs

  • Choosing now locks you in for years

    SCA, SAST and posture tools are folding into platforms. The selection made this year sets the architecture for the next several, and most of the advice available is vendor-funded.

    We sell no licenses, hold no partner tiers and take no referral fees

The work

Twelve engagements, each with a shape you can approve and an edge you can hold us to.

Every one of them states what it is not, as plainly as what it is. Open any of them for the stages, what we need from you to hold the price, and where the scope stops.

Start here

Not sure which one? Start with the diagnostic.

Two to three weeks, fixed fee. You get your pipeline modeled as it actually runs, exposures ranked by what is reachable rather than by CVSS, and a phased plan costed by phase — with phase one sized to the budget you have this year rather than the one you would need. The model stays yours, and every later engagement starts from it.

Book a scoping callRead the diagnostic scope

Every engagement here states what it is not, as plainly as what it is. If the honest answer is that you do not need us yet, that is in the scope too.