Trust boundaries, secrets, segmentation, auth, encryption. Bake security into the contour before scale — cheaper than any incident.
Rewriting the contour after an incident or due diligence burns cash, reputation, and deadlines. Set trust boundaries and access before load grows — you pay once for the scheme, not for the fire drill. Without it, security stays a checklist nobody runs.
In this engagement:
Threat and current-state workshop → target architecture and hardening map → prioritized backlog → implementation alongside engineering. You leave with a living document and contour changes the team actually uses. Scope and timeline lock after the review.
Both. On a greenfield build we bake the contour into architecture before production code. On a live system we map as-is, find critical gaps, and harden by blast-radius priority — no «rewrite everything» theater.
After a short review we lock the frame: workshop and scheme usually yield a clear work map fast; implementation depends on stack and debt. Pricing follows the hardening backlog — no mid-flight surprises.