Assess, instrument, operate, transfer.
Four phases with defined exits. Each ends with something you can hold, and the last one ends with your people running the capability without us.
- Assess
- 4 to 6 weeks
- Instrument
- 8 to 12 weeks
- Operate
- 2 to 4 cycles
- Transfer
- Contracted
Why the phases have exits
Advisory work in this sector has a well-earned reputation for never finishing. A discovery phase becomes a strategy phase, which becomes a pilot, which becomes a permanent line item that nobody can cancel because nobody can explain what would break.
Every phase here ends with a decision point where you can stop, change supplier, or continue, and where the work produced up to that point is yours regardless of what you choose. It costs us commercially and it is the reason clients let us near the important systems.
Assess
Four to six weeks. We map your current information picture, the sources you already pay for, the gaps that matter, and the legal boundary you operate inside. You get an honest account of what is worth building and what you should stop funding.
Narrative and threat assessment
Costed roadmap
Legal and data-residency finding
Instrument
Eight to twelve weeks. We stand up collection, classification, and the first operating picture against two or three questions your leadership actually asks. The scope stays narrow so that the system works and the results can be measured.
Monitors for priority subjects
Alerting with tuned thresholds
First quarterly assessment
Operate
Two to four operating cycles. Our analysts work beside yours on the daily product: briefs, evidence packs, escalations. Volume, latency, and accuracy are tracked against agreed thresholds and reviewed with you monthly.
Incident response support
Model and prompt tuning
Service level reporting
Transfer
The phase most vendors avoid. Your staff take the console, the runbooks, and the escalation authority. We certify operators, run the handover exercises, and step back to a support line you can cancel.
Runbooks and schemas
Source and licence assignment
Support agreement, terminable
What the first ninety days look like.
The assessment runs against your existing sources while the platform work starts in parallel, so the instrument phase is not waiting on a document.
- Weeks 1 to 3. Access, legal boundary, and the interviews that establish what your leadership actually asks for. The first source inventory usually surprises the client more than us.
- Weeks 4 to 6. Capability baseline and costed roadmap delivered, with the parts we recommend against stated as clearly as the parts we recommend.
- Weeks 7 to 12. Collection live, first monitors and requirements instrumented, alerting tuned against your own escalation history rather than a default.
- From week 13. Daily product, monthly service review, and your staff already inside the delivery team rather than waiting for a training week at the end.
How engagements are priced
Fixed fee where the scope can be fixed, and time and materials only where it genuinely cannot. We will tell you which one applies before you ask.
| Phase | Basis | Typical duration | What you keep if you stop |
|---|---|---|---|
| Assess | Fixed fee | 4 to 6 weeks | The full assessment, roadmap and costings |
| Instrument | Fixed fee per scope | 8 to 12 weeks | A working platform in your environment |
| Operate | Monthly, capped | 2 to 4 cycles | The platform, the tuning and the product produced |
| Transfer | Fixed fee | Contracted | Everything, plus certified operators |
Who arrives
Small teams of people who have done the work before, rather than a pyramid with one experienced name on the cover.
Engagement lead
Owns the outcome and the relationship with your sponsoring official. Present in country for the critical phases.
Intelligence analysts
Regional and language specialists who produce the daily product and train your cohort alongside it.
Platform engineers
Infrastructure, data pipelines, and model serving. They deploy into your environment and document as they go.
Governance adviser
Legal boundary, data protection, and the assurance evidence your inspectorate will eventually ask for.
Engagement questions
What sponsoring officials ask before they commit a budget line.
Can we start with a single question rather than a programme?
That is the preferred start. One question your leadership genuinely asks, instrumented properly, tells you more about whether this will work for you than a six-month strategy exercise.
Do you work through a local partner?
Where local content rules or security clearance require it, yes, and we will name the partner before contracting rather than after. Where it is not required we prefer to work directly, because a layer of subcontracting mostly adds cost and distance.
What do you need from us to start?
A sponsoring official with authority, a named counterpart who can open doors internally, and a clear statement of the legal boundary. Data access can be negotiated afterwards. Political cover cannot.
How is knowledge actually transferred?
Your engineers and analysts sit in the delivery team from the first week rather than attending training at the end. Certification against a defined standard closes the transfer phase, and we will hold that certification back if the cohort is not ready.
Start with an assessment.
Four to six weeks, fixed fee, and an honest account of what is worth building and what you should stop paying for.