Assess
AI Application Security Assessment
Assess how your AI surfaces behave when instructions, identity, data, tools, and application controls disagree.
Fixed scope
Engagements
Work
Engagements with Viewyonder are forward-deployed and concrete. I work directly with your engineering team — alongside the code, in your repos, in your stand-ups. Three shapes: a one-week healthcheck when you need a sharp diagnosis, a two-to-three-week plan when the diagnosis is in hand and the roadmap isn't, and a four-to-twelve-week project when the work has to actually ship. Code, not decks. One pillar at a time. Pricing published below.
Four pillars · three phases
The service matrix
Four pillars, three phases. Twelve named pieces of work, each one buyable as a fixed-fee healthcheck, a fixed-fee plan, or a day-rate project. Pick the row by what you need; pick the column by how far along you are.
| Pillar / flagship | AssessHealthcheck | PlanPlan | ExecuteProject |
|---|---|---|---|
| Security Injectionator → | | Plan Threat model + remediation roadmapThreat model + remediation roadmap. 2–3 weeks | Execute Guardrails, Injectionator, red teamDeploy guardrails, embed Injectionator, train red team. 4–12 weeks |
| Cost Intelligence Stater → | Assess Token cost-yield auditToken cost-yield audit across your AI applications. 1 week | Plan Registry + metering + optimiser designStater registry + metering plan + optimiser design. 2–3 weeks | Execute Build, instrument, hand overBuild the optimiser, instrument the apps, hand over to team. 4–12 weeks |
| Development Coherence → | Assess Spec-to-implementation drift auditSpec-to-implementation drift audit. Where is your team losing intent? 1 week | Plan Intent Coherence playbook + Lode designIntent Coherence playbook + Lode design for your stack. 2–3 weeks | Execute Implement tooling, embed in workflowImplement Coherence tooling and lode, embed in workflow, train team. 4–12 weeks |
| Operations GenAIOps → | Assess GenAIOps maturity assessmentGenAIOps maturity assessment across the six VOF pillars. 1 week | Plan Operating model + on-call + runbooksOperating model + on-call design + runbook templates. 2–3 weeks | Execute Stand up observability, run the playbookStand up observability, run the playbook, train on-call. 4–12 weeks |
Engagement shapes
Engagement shapes & pricing
Pricing is published, not negotiated. Five shapes; each one deliberately scoped so you know what you're buying before the first day of work.
- Healthcheck
-
Fixed-fee, 1 week, single pillar. Deliverable: a written report and a 60-minute walkthrough call.
£3,000 fixed-fee — ~3 days plus report & walkthrough.
- Plan
-
Fixed-fee, 2–3 weeks, single pillar. Deliverable: roadmap document, decisions log, prioritised backlog.
£6,000–£8,000 typical fixed-fee — ~8–10 days of work depending on stack complexity.
- Execute / Project
-
Day rate, 4–12 weeks, single or multi-pillar. Deliverable: working code, evals, runbooks, trained team.
£750 / day — day count varies with engagement intensity (part-time to full-time).
- Retainer
-
6-month commitment with a bank of days drawn down as needed. Days banked at start; expire end of period.
- Light · 12 days / 6 months (~2 days/month) · £9,000
- Standard · 24 days / 6 months (~4 days/month) · £18,000
- Heavy · 48 days / 6 months (~8 days/month) · £36,000
- Fractional CTO
-
Multi-month, equity or cash, by exception. Quoted individually.
All prices ex-VAT. UK practice; international engagements quoted in GBP.
Delivery
How a typical engagement runs
A Project is four to twelve weeks. The cadence below is the eight-week version — shorter engagements compress it; longer ones repeat weeks 4–8 against successive cells.
-
Week 1
Diagnose. Pair with the team. Read the repo, the evals, the on-call rota. Write the diagnosis in prose — what's working, what's drifting, what's missing. End-of-week walkthrough with whoever bought the engagement.
-
Week 2
Decide. Turn the diagnosis into a backlog with a sequence. Pull the highest-leverage items forward. Pin the metrics that will tell us if the work is helping.
-
Weeks 4–8
Build. Forward-deployed in your repos. Code review with the team. Evals running on every PR. Daily stand-up, weekly written progress note, mid-engagement recalibration if the metrics say so.
-
Final week
Hand over. The deliverables: working code in your repo, evals you can re-run, runbooks for the team that will own it, a trained team that doesn't need me on day one of week thirteen.
Boundaries
What I won't do
The shape of the work matters as much as the price of it. Three engagements I turn down by default.
- I won't run training programmes. Building a team's skill on the job during an engagement, yes — running a packaged training course as the product, no. There are better people for that.
- I won't build from scratch for non-technical founders with no engineering counterpart. Forward-deployed only works when there's a team to be deployed to. If you don't have one yet, the right next step is hiring, not contracting.
- I won't do deck-only work. Strategy decks without a working artefact at the end are the kind of engagement that quietly fails. Every engagement ships code, evals, or a decision the team can defend.
Start a conversation
Book a discovery call
Thirty minutes. First call is free. I'll tell you honestly if I'm the wrong person for what you need.
Book a discovery call