PM-10 · Standing mandate · Monthly
CVE custody.
CVE custody closes new critical vulnerabilities inside 7 days and keeps the month-end count at zero, with a signed evidence pack your auditor and insurer can read.
Works on any codebase, not only ones we built.
One month of custody · Sample data
The audit comes every year. The CVEs come every week.
The questionnaire asks for patch evidence nobody keeps.
The renewal reprices on a control you cannot show.
An ecosystem event lands, and nobody can say affected or clean.
What is signed every month, and the price
PM-10Monthly
Cancel any monthNew criticals fixed inside 7 days, zero at month close, with evidence.
Signed every month
- Zero critical advisories open at month close; new criticals closed inside 7 days
- High advisories resolved inside 30 days, each with a stated upgrade path
- Every fix ships as a reviewed pull request with a permanent test
- Monthly evidence pack your auditor and your insurer can read, signed by an engineer, with the supply-chain affected-or-clean attestation during an ecosystem event
Base
2,500 / month
Up to 5 repositories
Evidence
4,500 / month
Multi-repo, with the PCI and SOC 2 pack
- The buyer
- Bought by whoever answers the insurance questionnaire and faces the auditor. Engineering is consulted, never sold.
- The start
- Starts from a clean baseline: the CVE burn-down (PM-02) runs first, and its price is credited as month one.
- The terms
- Prepaid quarterly. Cancel any month. Works on any codebase, not only ours.
- The wedge
- The last page of every pack names the one thing we would fix next, priced. One item, never a list.
The questions, answered plainly.
What does CVE custody deliver every month?
What does it cost?
Do you take custody of a codebase already on fire?
Does it work on code you did not build?
What happens during a supply-chain event?
Who signs the work?
PM-10 · Standing mandate
Start free. The probe is the door.
The probe report says whether custody fits your codebase, before any money moves.