~1-4 Weeks

Brasstower conducts a security posture assessment against the client’s actual architecture threat surface, and business model.

A prioritized risk register specific to the client’s systems, stage, and adversary profile is developed covering:

• Existing security controls and their effectiveness,

• Architecture review of production systems,

• Threat model development,

• Identification of regulatory and compliance obligations, and

• A gap analysis against industry benchmarks relevant to the client’s market.

Outputs:

• Prioritized risk register. Issues ranked by business impact and exploitability, with ownership assignments and remediation cost estimates.

• Initial security roadmap. Sequenced remediation plan with timelines, resource requirements, and measurable success criteria.

• Written threat model. Adversary profiles, attack surfaces, and risk appetite boundaries that inform all subsequent roadmap decisions.

~4 weeks.

The risk register is converted into a prioritized roadmap calibrated to the client's headcount, budget, risk tolerance, and growth trajectory. Every item is assigned to one of three ownership categories:

• Brasstower: Work performed directly under the retainer — design reviews, architecture decisions, policy design, executive communication.

• Client: Work performed by the client's engineering or operations teams, with Brasstower providing guidance and review.

• Specialists: Work requiring domain-specific practitioners from the Brasstower bench — penetration testing, compliance audit preparation, cloud infrastructure hardening, etc — scoped and managed transparently without surprise costs.

Outputs:

• Security roadmap. Ownership assignments, timelines, and resource estimates for every item.

• Bench Plan. Identified specialist engagements with scope definitions and cost estimates sequenced against the roadmap.

• Stakeholder summary. Board-ready risk narrative for executive and investor audiences.

Ongoing.

Monthly retainer work against the roadmap. Scope and cadence scale to the client's needs — from a few hours per month for early-stage companies to a substantial weekly commitment for companies in active growth or facing regulatory pressure.

Ongoing execution work includes:

• Architecture and design reviews for new features, services, and infrastructure changes.

• Threat modeling for new product capabilities, integrations, and deployment patterns.

• Security review of system designs — including AI, ML, and agentic architectures, model deployment pipelines, tool-chain authorization — and traditional services.

• Incident triage and response guidance.

• Compliance program design and gap assessment — SOC 2, HIPAA, PCI-DSS, GDPR, particularly at the intersection of these frameworks and AI workloads.

• Board and executive communication — quarterly risk briefings, investor-facing security narratives.

• Engineering team integration — PR reviews, design document review, participation in architecture meetings.

Brasstower integrates into the client's existing tools — Slack, Teams, Jira, Notion, GitHub, Google Workspace — and participates in relevant design and engineering discussions.

Outputs:

• Monthly deliverables. Completed roadmap items with written documentation.

• Updated risk register. Re-prioritized as the threat surface and business evolve.

• Design reviews and threat models. Written artifacts for every significant architecture or product change.

Optional Offramp

When the client's scale, risk profile, or organizational maturity justifies a dedicated internal security leader or team, Brasstower helps build that capability and transitions out.

Transition work includes:

• Job description and leveling criteria for the security hire.

• Candidate interview loop participation and evaluation.

• Onboarding the new hire with institutional knowledge — risk register, roadmap, threat models, architecture context, and relationship map.

• Structured handoff period, typically 1–2 months, where Brasstower and the new hire overlap.

Outputs:

• Hiring package. Job description, leveling criteria, and interview rubric tailored to the client's specific security needs — including culture match.

• Knowledge transfer documentation. Consolidated risk register, roadmap, threat models, and architectural context in a format the incoming hire can operate from on day one.

• Transition plan. Defined handoff milestones and exit criteria so the end of the engagement is clean, not abrupt.

The goal is to build the security capability the client needs — not to create dependency on the advisory relationship.