## URL: /engagement-models/ We structure offensive-security engagements through four retail models, plus three partnership-channel models documented separately. Choosing the right model is part of [Discovery and Scoping](/methodology/scoping/) — the structure changes the cost, the deliverable, and the contractual frame, not the technical quality. ### The four retail models at a glance | Model | Best for | Pricing structure | Typical duration | |---|---|---|---| | **Fixed Package** | Standard service work with known scope | Quoted fixed price after scoping | 2-6 weeks | | **Scoped Assessment** | New or complex scope where rough sizing exists | Range estimate, finalized during engagement | 4-12 weeks | | **Custom Engagement** | Unique scope, novel attack surface, R&D-flavored | Time-and-materials or hybrid | 6+ weeks | | **Retainer** | Ongoing relationship; recurring assessment + advisory | Annual contract with quarterly cycles | 12 months | Partnership-channel models (for security firms reselling Melina capabilities) are documented separately in the [Partnerships silo](/partnerships/). --- ## How to choose The choice between models is driven primarily by **scope clarity** and **engagement frequency**: - **High scope clarity, one-time engagement** → Fixed Package - **Moderate scope clarity, one-time engagement** → Scoped Assessment - **Low scope clarity OR exploratory work** → Custom Engagement - **Recurring engagement need, multi-quarter relationship** → Retainer If you don't know which to choose, the answer is almost always: start with a [Discovery Call](/methodology/discovery/) and we recommend a model after understanding your system and goals. Choosing wrong at the outset is recoverable — we can convert one model into another during the engagement if scope reality differs from assumptions. --- ## CTA Ready to start? [Request Assessment →](/contact/request-assessment/) or [Talk about a retainer](/contact/request-assessment/?model=retainer). --- # Fixed Package ## URL: /engagement-models/fixed-package/ **When to choose this model:** known scope, standard service type, defined deliverable. ### What it is Fixed Package is our default model for engagements with well-defined scope. After [Discovery and Scoping](/methodology/scoping/), we deliver a quote with a fixed price, a fixed scope, and a fixed timeline. If during the engagement the scope expands meaningfully, we surface that immediately and either negotiate a scope addendum (converting the engagement to a Scoped Assessment) or proceed within the original scope. ### Best for - Mobile, web, or API penetration testing where the system is well-understood - Cloud architecture review with a defined target environment - GRC readiness assessment with an established framework target (ISO 27001, SOC 2, MLPS L2) - ECU pentest for a known vehicle subsystem - Single-purpose IoT device assessment with bounded firmware ### Deliverable - Bilingual EN + 中文 report (executive summary + technical findings) - Per-finding evidence package, CVSS rating, remediation guidance - 60-day remediation re-check - Optional knowledge-transfer workshop ### Risks of this model If scope is less clear than assumed at quote time, Fixed Package can constrain the engagement in ways that produce a less useful report. When we sense this risk during scoping, we recommend Scoped Assessment instead. ### Related - [discovery call](/contact/) - [Methodology](/methodology/) - [Request Assessment with Fixed Package preference](/contact/request-assessment/?model=fixed-package) --- # Scoped Assessment ## URL: /engagement-models/scoped-assessment/ **When to choose this model:** moderate scope clarity, complex system, or where scope evolution during engagement is expected. ### What it is Scoped Assessment is the middle ground between fixed-scope and time-and-materials. We deliver a range estimate at the outset (e.g., "RMB X to Y, depending on scope finalized during the engagement") and converge to a specific cost as the engagement progresses. The client is consulted at clear decision points where scope choices affect cost. ### Best for - Multi-ECU automotive systems where the in-scope ECU set may change as we learn the architecture - AI/ML system assessment where the relevant attack surface depends on what we find during early testing - Multi-cloud or hybrid-architecture review where the relevant target set isn't fully known at quote time - Engagements bridging multiple service lines (e.g., IoT device + cloud backend + mobile companion app) ### Deliverable Same as Fixed Package — bilingual report, evidence package, 60-day re-check, optional workshop. ### How it works in practice We define an initial scope and budget envelope. During the engagement, we surface scope decisions early — for example, "we've discovered three additional ECUs in the platform that meet the threat criteria; including them adds approximately 15% to the budget; do we include them, defer, or descope something else?" The client decides at each decision point; we proceed within the agreed scope. ### Related - [discovery call](/contact/) - [Methodology: Scoping](/methodology/scoping/) - [Request Assessment with Scoped preference](/contact/request-assessment/?model=scoped) --- # Custom Engagement ## URL: /engagement-models/custom-engagement/ **When to choose this model:** novel scope, exploratory or R&D-flavored work, or scope so unique that standard package structure doesn't fit. ### What it is Custom Engagement is time-and-materials with milestone-based deliverables. Used when scope cannot be reasonably bounded at the outset — for example, research engagements, novel attack-surface exploration, or projects where the deliverable structure itself is part of the engagement. ### Best for - Pre-product-design threat modeling for a new connected-system category - Research engagements where the question is "what attack surface exists" rather than "is this system secure" - Multi-stage work where each stage's scope depends on prior stages' findings (assessment → tool development → operational red team) - Bespoke advisory work bridging cybersecurity strategy and technical implementation ### Deliverable Structured per engagement. May include: research reports, threat models, custom tooling, training, advisory documents. Defined in the SOW with milestone-based delivery checkpoints. ### When NOT to use For work with a recognizable name in our standard catalog (e.g., "IoT pentest," "MLPS readiness"), one of the other three models is almost always better. Custom Engagement should not be used to avoid scoping discipline. ### Related - [discovery call](/contact/) - [Request Custom Engagement consultation](/contact/request-assessment/?model=custom) --- # Retainer ## URL: /engagement-models/retainer/ **When to choose this model:** ongoing relationship, recurring assessment + advisory needs, multi-quarter horizon. ### What it is Retainer is a 12-month framework agreement for organizations with recurring assessment + advisory needs. The retainer reserves a budgeted volume of specialist time per quarter, with predictable cost and priority access to Melina's team. ### Best for - OEMs and Tier-1 suppliers running ongoing cybersecurity programs (per ISO/SAE 21434 cadence) - Connected-device manufacturers with continuous release pipelines requiring per-release security gates - Organizations with a recurring research-advisory need (incident-response readiness, design-review cycles, threat-modeling refresh) - Compliance-driven organizations needing recurring assessment evidence ### What's included - Reserved specialist time per quarter (configured at contract signing) - Priority access — retainer engagements take scheduling precedence over inbound Fixed Package work - Quarterly delivery reviews - Annual cybersecurity-posture summary - Discounted rate on additional work beyond the retainer envelope ### Re-check on retainer The 60-day remediation re-check is performed against each retainer-quarter's findings as a standing commitment, not separately scheduled. ### Related - [discovery call](/contact/) - [Methodology: Re-check](/methodology/re-check/) - [Request Retainer discussion](/contact/request-assessment/?model=retainer) --- End of engagement-models/article.md (hub + 4 detail, placeholder draft).