Buy an outcome, not an hour.
Fixed-fee retainer packages backed by UC Berkeley cybersecurity credentials and former KPMG Cyber & Forensics practice leadership. Delivery is overwhelmingly automated through nTrust's own appliances, which is why we can price outcomes instead of timesheets — and why we never bill by the hour.
All prices below are stated in USD with the equivalent CAD at our fixed 1.25 CAD-per-USD sovereign rate. Business costs are incurred in USD, so USD is the base currency; Canadian enterprises receive a preferential domestic rate rather than absorbing market FX volatility.
$2,500 USD · $3,125 CAD per month (Enterprise Multi-Dept: $5,000 USD / $6,250 CAD)
- Turnkey deployment on your own Cloud VPS or dedicated hardware
- 24/7 nTrust Remote Management Mesh monitoring & OTA updates
- Pre-loaded
RevForge™(SEO, Social, Proposal & Lead Conversion) &DevForge™(Offshore Dev Sprint) skins - Built-in White-Label Client Rooms (
/exchange/[token]via Hosted Cloud Relay, Direct VPS DNS, or Vercel Edge) - TokenShield™ (:8443) privacy scrubbing (Lean Regex Fast-Path or Full Presidio NLP)
- BYO-AI subscription sizing (OpenRouter, Gemini, Claude) with SpendGuard™ budget caps
$6,500 USD · $8,125 CAD per month
- Production threat modeling for serverless GPU inference
- TokenShield prompt WAF and PII scrubbing deployment
- Model Context Protocol tool sandboxing
- EU AI Act and NIST AI RMF audit defense binders
- 15 deep-dive review hours per month as an internal guardrail
$5,000 USD · $6,250 CAD per month
- Dedicated virtual CISO leadership
- Quarterly board and executive cyber risk briefings
- Continuous ISO 27001, SOC 2 and DORA readiness cockpit
- Third-party SaaS and vendor contract auditing
- Zero-trust client rooms for deliverable access
- 20 retained advisory hours per month as an internal guardrail
$3,500 USD · $4,375 CAD per month
- Guaranteed incident commander dispatch within 60 minutes
- Volatility memory and EVTX/SIEM forensics
- Court-defensible forensic binder with chain of custody
- Statutory filing drafts for DORA, NIS2, SEC, HIPAA, PIPEDA
- 10 standby readiness hours per month as an internal guardrail
- Active surge capacity on pre-agreed terms
Annual prepaid: $42,000 USD · $52,500 CAD
$4,500 USD · $5,625 CAD per month
- One certified manual penetration test per quarter
- Continuous daily attack surface scanning
- ASVS v5 code reviews and DevSecOps pull request patches
- Automated cloud drift remediation
- 15 developer remediation advisory hours per month
Fully funded by the nTrust Foundation — grant value $5,000 USD per month
- 100% grant-funded — no net amount due
- Continuous posture hardening for community assets
- Email authentication, TLS and DNS drift monitoring
- Quarterly plain-language security briefing
Every package is an outcome retainer. Retained hours shown above are internal capacity guardrails that protect against scope creep — they are never presented to you as a billable hourly rate.
Retainer comparison
Side-by-side pricing, response tier, and primary outcome.
| Package | USD / month | CAD / month | Primary outcome |
|---|---|---|---|
| Managed Spine™ AI OS & Autonomous Department | $2,500 | $3,125 | Turnkey self-hosted Spine AI OS + RevForge™/DevForge™ skins, BYO-AI SpendGuard & TokenShield™ (:8443) |
| Sovereign AI Deployment & Governance | $6,500 | $8,125 | Certified secure, audit-defensible AI deployment |
| Sovereign vCISO & Strategic Assurance | $5,000 | $6,250 | Executive cyber leadership and continuous compliance |
| Rapid Incident Response & Forensic Command Standby | $3,500 | $4,375 | 60-minute incident commander dispatch, 24x7 |
| Continuous ASPM & Offensive Penetration Testing | $4,500 | $5,625 | Continuously tested, drift-free attack surface |
| Foundation Sovereign Community Grant | $0 | $0 | Grant-funded protection for community institutions |
Incident response standby is also available as an annual prepaid commitment at $42,000 USD or $52,500 CAD. The vCISO package is available annually at $50,000 USD paid upfront.
Not sure which retainer fits?
Describe your sector, regulatory exposure, and current security stack. We will recommend the smallest package that actually removes the risk, and tell you plainly if that is none of them.