How We Build: A Custom Development Proposal

This page is the proposal. It sets out how we scope, build and hand over a custom security architecture — and, just as importantly, when you should not buy one from us.

The delivery plan

Phase detail

1. Discovery — 2 to 4 weeksEvery OS build, kernel version, router model, control system and unmanaged device, including the ones nobody on the org chart owns. Constraints captured as hard inputs: outage windows, vendor warranties, regulatory deadlines. Output is an estate map and a threat model specific to you.
2. Design — 2 to 4 weeksReference architecture, control mapping, data flows, and the acceptance tests the build will be measured against. Acceptance criteria are agreed here, in writing, before anything is built — so "done" is not a negotiation later.
3. Pilot — 3 to 6 weeksA representative ring, not just IT laptops. Prevention runs in detect-only while we establish what normal looks like in your environment.
4. Tune — 3 to 6 weeksSuppressing the noise your environment generates legitimately. This is the phase most rollouts underfund, and it is the one that decides whether your team trusts the platform or quietly disables it.
5. Enforce — phasedPrevention and automated containment moved to blocking, ring by ring, with a tested rollback at every gate.
6. Handover — 2 weeksSource, build pipeline, signing process, detection documentation, runbooks and training. Or we keep operating it under MDR — but that is your choice, not a dependency we engineered in.

Why a custom stack, honestly

A pre-built platform is the right answer more often than a firm like ours likes to admit. Here is where each genuinely wins.

The argument against us, stated plainly

Custom software has a maintenance cost that never ends. A commercial vendor amortises research, threat intelligence and platform engineering across thousands of customers; you cannot match that spend alone, and anyone claiming otherwise is not counting properly. If your estate is mainstream and your constraints are ordinary, buy the product — we will tell you so, and we would rather do that than sell you eighteen months of work you did not need.

The case for custom is not that it is better in general. It is that for a specific set of constraints, the pre-built option does not actually run, or runs at a cost that does not make sense. That is a narrow claim, and it is the only one we make.

The hybrid most engagements actually land on

Commercial platform across the estate where it fits, custom engineering for the segment where it does not, and integration work joining them so the two halves act as one architecture. That is the most common shape of the work we do, and usually the cheapest defensible answer.

What you own at handover

Source code

For every custom agent, integration and build script we write

Build pipeline

Reproducible, with a published manifest — you can rebuild and get the same bytes

Signing process

Keys and ceremony documented, held by you

Detection content

Every rule, with its rationale and false-positive profile

Architecture

Diagrams, data flows, threat model, decision log

Evidence

Control-to-artifact mapping for your assessors

If CerbaCore disappeared, your team could build, sign, deploy and maintain everything we delivered. A system you cannot maintain without us is a dependency, not a deliverable.

Commercials

• Discovery is fixed-price and standalone. Its output is useful whether or not you continue with us, and you are free to take it to another firm.
• Design and build are fixed-price per phase against the acceptance criteria agreed in design. Not time and materials — scope risk should sit with us, not with you.
• Operations are a monthly subscription with a defined exit: notice period, data export and knowledge transfer written into the contract from day one.

Where to start

Discovery. It is the smallest commitment that produces something genuinely useful — an accurate estate map, a specific threat model, and a costed list of what would actually reduce risk. Many clients run it and then do the top three items themselves. That is a legitimate outcome.

A worked engagement, end to end

Client: 1,200-seat manufacturer with a defense subsidiary. Mixed Windows and Linux, two plants, a CMMC Level 2 requirement on the subsidiary, and an EDR product deployed two years earlier that the team had stopped looking at.

Phase	Weeks	Key output	What surprised them
Discovery	1–4	Estate map, threat model, costed options	317 unmanaged hosts, including 40 on the plant network
Design	5–8	Architecture, control map, acceptance tests	The existing EDR was adequate — the deployment was not
Pilot	9–14	Ring 0 and 1, detect-only	Alert volume was a tuning problem, not a product problem
Tune	15–20	Baseline, suppression set, runbooks	4,000 alerts/week to 95
Enforce	21–30	Blocking, segmentation, auto-quarantine	Plant segmentation took two extra windows
Handover	31–32	Source, docs, training	They took operations in-house; we kept the CMMC workstream

What "fixed price per phase" means

Phase	Commercial model	Who carries scope risk
Discovery	Fixed price, standalone, output is yours	Us
Design	Fixed price against discovery findings	Us
Build / pilot / tune	Fixed price against agreed acceptance criteria	Us
Enforce	Fixed price per ring	Us
Change beyond agreed scope	Change order, priced before work starts	Discussed, never assumed
Operations	Monthly, defined exit	Shared, with notice both ways

If we estimate a phase badly, that is our problem. Time-and-materials moves estimation risk onto the client, who has the least information with which to manage it.

Decision aid — should you call us at all?

1. Is your estate mainstream?Current Windows and macOS, cloud-managed, internet connected, no unusual regulatory burden. If yes, buy a commercial platform and spend the savings on tuning it properly. You do not need us.
2. Do you have a coverage problem or a product problem?Most organizations that believe they need a new platform actually have an untuned deployment and an incomplete inventory. Discovery answers this in four weeks for a fixed fee.
3. Is there a segment the commercial option genuinely cannot reach?Air-gapped, embedded, vendor-locked, unsupported OS. That segment is the case for custom work — and usually only that segment.
4. Do you have to explain the detection logic to someone?An assessor, a regulator, a board. Opaque vendor models become a problem exactly when you are under scrutiny.
5. Can you maintain what we build?If the honest answer is no and you do not want a managed service either, custom software is the wrong choice and we will say so.

How engagements actually end

Outcome	Roughly how often	What it looks like
Discovery only	Common	They take the report and do the top items themselves. Legitimate and expected.
Build, then in-house operations	Most common	Full handover with source and training
Build, then managed operations	Common	We run it; exit terms in the contract from day one
We decline	Occasionally	Requirement needs an authorization we do not hold, or a commercial product fits better