Qompute AI
Services

Engineering you can hire, with scope and fees stated up front.

Three kinds of work, delivered by the founders: AI security assessment and testing, private-AI deployment and integration, and embedded security engineering. Every engagement is scoped in writing before it starts.

Discuss a projectCompare the three
01

AI security assessment and testing

You run AI systems with real authority, or are about to, and need a decision-grade view of how they can be abused and whether you would notice.

A defined review of an agreed AI workflow, architecture, or authority boundary, under written rules of engagement: architecture and asset map, telemetry review, attack-path reconstruction, and targeted validation of the highest-risk assumptions.

You receive
Findings against a ten-part standard, a prioritized control backlog, a technical readout with an execution-path graph, and hunt queries where your data permits. Validation of fixes is included only when the scope says so.
Fee basis
Rapid threat picture: three weeks, fixed scope, $75,000 fixed fee (USD).
qore
Not involved. Works on any stack; no qore license.
Discuss this work Scope and fees
02

Private-AI deployment and integration

You need AI running on data that cannot leave your boundary, on hardware you control, with identity and policy someone can answer for.

Assess requirements, plan an approved environment in writing, implement it with your engineers on your hardware, and hand it over with operating guidance. The assessment covers a local stack you already run or a qore deployment; it does not assume every model, hardware configuration, or integration is supported.

You receive
A written deployment plan; a running installation with a configuration record; operator runbooks; and, for a pilot, success criteria agreed first and a closing report at the end.
Fee basis
Scoped in writing after a discovery call: fixed deliverables and a fixed price or a capped budget. The deployment assessment runs one to two weeks and needs no qore license.
qore
Optional. qore preview access during an engagement is granted under the preview terms, separately from the service fee.
Discuss this work Scope and fees
03

Embedded security engineering

You know the problem and want it fixed, detected, and owned inside your team rather than described in a report.

Defined implementation, detection, remediation-validation, or incident-readiness work alongside your security and platform engineers: remediation design, production detections, containment engineering, and proof that the same path no longer works.

You receive
Production controls and detections, validated remediation, runbooks, and a trained internal owner. Longer engagements add normalized telemetry, recurring discovery, release validation, and transition to named owners.
Fee basis
Embedded adversarial operations: six weeks, $150,000 fixed. Security capability buildout: twelve weeks, $275,000 fixed. Ongoing adversarial coverage by agreement, $50,000 per month reference, limited seats. Active incident support is priced weekly from a signed emergency letter.
qore
Not involved. Works with the providers and tooling you already have.
Discuss this work Scope and fees

Fees are in US dollars and exclude taxes. Fixed offers assume access begins within five business days of signature; when a budget is below an offer we reduce scope before we reduce quality. Two principals lead every engagement, so capacity is limited and confirmed before signing.

How an engagement runs

Four steps, nothing implied.

The first conversation is a conversation. Assessment, implementation, and continuing support are each their own scoped, paid work; none is mandatory when your need does not require it.

  1. First conversationForty-five minutes with an engineer. You describe the problem and the outcome you need; we say whether we are the right people and which offer fits, or that none does. A conversation, not a free assessment, and not a sales script.
  2. Written scopeDeliverables, dates, who from each side, access needed at a high level, and the fee. Adversarial work also gets signed rules of engagement. Nothing starts until it is signed.
  3. The workOn your systems, with your engineers in the room or on the call. Every configuration decision and every finding is recorded as we go, not reconstructed at the end.
  4. Validation and handoverProof that the agreed outcome holds, written deliverables your reviewers can use, and a named owner on your side. A paid assessment can end in a decision rather than an implementation; the scope says which.
The two service pages

Where the detail lives.

Securing the AI you already run

AI security engineering

Security for AI systems that can act. Assessment and testing, embedded engineering, ongoing coverage, and active-incident support for AI systems that can act, on any stack.

  • AI infrastructure operations
  • Agentic security
  • AI supply chain assurance
  • Continuous adversarial validation

Offers, fees, and method

Building private AI inside your boundary

Private-AI deployment and integration

Assessment of what you have and what you need, a written plan, implementation with your engineers, and a handover your operators can run. For a local stack you already run, or for qore.

  • Deployment assessment
  • Guided installation and hardening
  • Operator and governance workshop
  • Builder enablement
  • Pilot leadership
  • Evidence-handling and incident-readiness review

Engagements and deliverables

Boundaries

Authorized, written, stoppable.

All work is authorized defensive work. Adversarial modules run only under written scope with named systems, approved test identities, stop conditions, and evidence-handling rules. We do not test systems we are not contracted to test.

Read the rules-of-engagement template

Before you ask

Questions buyers ask first.

Is qore required for any of this?

No. AI security assessment and embedded security engineering work on whatever stack you run, with the providers you already have. Private-AI deployment covers a local stack you already run or a qore deployment; the deployment assessment needs no qore license. qore is a separate product in private preview.

What does the first call commit us to?

Nothing. It is a forty-five-minute conversation with an engineer about the problem and the outcome you want. We say whether we fit and which offer applies, or that none does. It is not a free assessment; assessment is paid work with its own deliverables.

How are fees set?

Fixed offers have a fixed scope and a fixed fee, stated on the service page in US dollars. Everything else is scoped in writing after the first call with fixed deliverables and a fixed price or a capped budget. Active-incident work is priced weekly from a signed emergency letter. There is no rate card beyond that, and nothing is invoiced before scope is signed.

Do we have to replace our incident-response or testing firm?

No. They keep counsel and insurer coordination, broad investigation, scheduled testing, and independent assurance. We take the embedded, AI-specific gap and work beside them under a day-one charter.

What access and participation do you need?

Only what the written scope lists. Work starts passive: architecture, configuration, logs, telemetry, and time with your engineers. Adversarial modules use named test identities against named systems inside an authorization window with stop conditions. An executive sponsor and a senior engineering owner available to us make an engagement work.

What happens after we send an inquiry?

Derek Hinch or Joey Victorino reads it and replies personally, usually within two business days, with whether we fit and a proposed call time. Inquiries marked as an active incident are read first and answered the same business day, US Pacific.

Discuss a project

Tell us the outcome you need.

Name, email, and the kind of work. Everything else is optional. A person replies with whether we fit and what a scoped engagement would look like.

Evaluating qore rather than hiring the team? Request access on the qore page.

One or two sentences is enough. No credentials, secrets, prompts, or customer data here; detail moves under a signed agreement.
More detail (optional)
Inquiries marked as an active incident are read first and answered the same business day, US Pacific.

Derek Hinch or Joey Victorino reads it and replies personally, usually within two business days, with whether we fit and a proposed call time. Nothing is scheduled or committed by sending this form. Privacy notice.