Every engagement is priced after a 15-minute scoping call. Audits are fixed-scope: perimeter, duration and deliverable are set before we start, no open-ended time and materials. The retainer is monthly with no duration commitment. Specialised engagements (IAM redesign, Landing Zone, audit prep) are quoted after scoping.

2 weeks for a cloud posture or supply chain audit, 3 weeks for the AI Act audit. Concretely: week 1 = mapping + interviews + collection, week 2 = analysis + prioritised action plan. You walk away with an operational document, not slideware.

Four classic moments: (1) a SOC2, ISO 27001, NIS2 or DORA audit is announced for the next 6 months, (2) an enterprise customer sends a security questionnaire nobody knows how to fill in, (3) an AI feature is going to production on customer data, (4) your CSPM reports 3,000 findings and the team doesn’t know where to start. If you recognise yourself, it’s the right time.

No. Distribuée does configuration audits, architecture reviews and pipeline hardening: the work that shrinks the attack surface before an attacker or a pentester finds it. For offensive penetration tests we work with qualified partners, and we help you scope the engagement and act on the results.

Directly, exclusively with your engineering team. No subcontracting, no partner firm. That’s what keeps the rigor and speed.

Yes, via a dedicated read-only role (IAM role on AWS, equivalent on Azure/GCP), extended only if the audit requires it. Everything is traced in your audit logs, MFA mandatory, access revoked on the last day of the engagement. No static keys.

The one that matches your size and maturity. For SMBs, native tooling (Security Hub, GuardDuty, Inspector, Defender for Cloud) is often enough when properly configured. Wiz, Orca or Prisma Cloud make sense above a certain volume or in multi-cloud. We are independent, not resellers: the deliverable explains what to pick and why.

AWS is our home turf, with Professional and Security Specialty certifications. Supply chain topics (GitHub Actions, containers, ArgoCD, Kubernetes) and CSPM are cloud-agnostic, and we work on Azure and GCP on those perimeters. For a deep native Azure or GCP architecture review, we say so during scoping.

Under NDA for most. During a scoping call, we can share 2-3 anonymised references matching your industry and size. Named references are possible after a follow-up call and NDA signature.