Security advisory retainer
A senior security voice in the room, without hiring one.
What it is
Most of the decisions that determine whether a product gets exploited are made months before an audit: how upgrades work, who holds which key, which dependency gets trusted, what the pause path is. By audit time those are expensive to change.
A retainer puts a senior auditor in those conversations while they are still cheap. It is the function a CISO performs, sized for a team that cannot justify hiring one.
What we examine
- Architecture and threat-model review before code is written, not after.
- Design reviews on request: an engineer can send a pull request and get a real answer.
- Key management and admin structure designed with you, then documented.
- Dependency and integration decisions reviewed before you take the risk on.
- Security input into hiring, process and incident readiness.
- A standing point of contact who already knows your system when something happens.
- Priority scheduling for audits when a release is coming.
What you get
Written recommendations after each review, not just a conversation.
A maintained threat model that changes as the product does.
Documented key and role structure the whole team can see.
Agreed monthly hours, with unused time visible rather than quietly billed.
How the engagement runs
- 01
Onboard
We learn the system properly: architecture, keys, dependencies, roadmap. Fixed monthly fee.
- 02
Embed
In the channels where decisions are made, reviewing designs as they appear.
- 03
Review
Scheduled deep reviews each cycle, plus ad hoc answers in between.
- 04
Adjust
The threat model and the hours are revisited quarterly against what you actually used.
What we cover
Languages
- Solidity
- Vyper
- Rust
- Move
- Cairo
- Go
- TypeScript
- Huff
- Yul
Chains
- Ethereum
- Solana
- BNB Chain
- Polygon
- Avalanche
- Arbitrum
- Base
- TRON
- Optimism
- Cardano
- Polkadot
- Cosmos
- NEAR
- Aptos
- Sui
- TON
- Hedera
- Algorand
- Stellar
- Starknet
- ZKsync Era
- Linea
- Sei
- Sonic
- Scroll
- Mantle
- Injective
- Cronos
- Celo
- Gnosis
- Fantom
- Kaia
- Ronin
- Immutable
- Blast
- Berachain
- Monad
- Hyperliquid EVM
- Stacks
- Rootstock
- Kava
- Osmosis
- MultiversX
- Conflux
- Telos
- Theta
- Chiliz
- XDC Network
- Filecoin FVM
- Ontology
- WEMIX
- Fuel
- Taiko
- Polygon zkEVM
- BOB
- Fraxtal
- Mode
- ZetaChain
- Metis
- Manta Pacific
- IOTA EVM
- Neo X
- Unichain
- World Chain
- Soneium
- Abstract
- Ink
- Movement
- Plume
- Etherlink
- EOS
- Flow
- Zilliqa
- Harmony
- Moonbeam
- Astar
- Aurora
Not listed? Ask. If it runs smart contracts, we almost certainly review it.
Questions we get asked
How is this different from buying audits?
An audit is a snapshot bought after the fact. A retainer is judgement available while the decisions are still open, which is when it costs least to change them.
Does it include audits?
No, and bundling them would create the wrong incentive. Retainer clients get priority scheduling and a discount, but an audit is quoted separately and reviewed with the same independence.
What size team is this for?
Teams with real value at stake and nobody whose job is security. Below that, buy an audit when you need one. Above it, hire someone and use us to review their work.
Can we start and stop?
Monthly, with a notice period stated in the agreement. We would rather you leave when it stops being useful than stay out of inertia.
Often bought with
Monitoring and incident retainer
Continuous on-chain monitoring with automated response, and a team on call when something moves.
Web3 and protocol audit
Line-by-line review of contracts, chain layer and upgrade paths, with proof-of-concept for every finding.
Build, harden and maintain
Engineering that implements the security work rather than recommending it.
Tell us what you are building and when you launch. Fixed quote in 48 hours.
Get a fixed quote