Merlin InfoTech logo MERLIN INFOTECH
SECURE · RELIABLE · FUTURE READY
Get a scoped quote
AI · Cybersecurity · Cloud

Security, cloud and AI leadership for growing companies.

Priced to the work, not to a tier list. We scope your systems, compliance obligations and internal bandwidth first, then quote a fixed number.

1–3 daysto a written proposal
Fixed feeon every assessment
No lock-inretainers cancel at 30 days
Vendor-neutralno resale margin
What your quote is built from
Systems in scope14 workloads
Compliance obligationHIPAA + SOC 2
Your internal bandwidth1 sysadmin
Board reporting cadencequarterly
Illustrative engagement$18k + $6.5k/mo
Frameworks we assess and build programs against
  • NIST CSF
  • CIS Controls
  • ISO 27001
  • SOC 2
  • HIPAA
  • PCI-DSS
  • CMMC
  • NIST 800-171
  • DORA
  • NIS2
  • GDPR
  • CCPA
  • HITRUST
  • AWS Well-Architected
  • FedRAMP-aligned
Services & typical ranges

Five practices, one fixed quote.

Request the full rate card →

Every engagement ends in a written, fixed quote. Where you land inside a range depends on scope, not on how the negotiation goes.

01

AI Advisory & Implementation

AI Readiness Assessment

3–8 weeks

Find out where AI will pay off before spending on tools: workflow and bottleneck analysis, a data audit covering quality, access and governance, a stack review, and team change-readiness. A lower-cost quick-start version is available.

Deliverable: AI Readiness Scorecard with a prioritized opportunity map.

$12k–$40k
fixed fee
Scope it →

AI Strategy & Security

follows readiness

Use cases scored on ROI, feasibility, data readiness, risk, timeline, strategic alignment and team capacity, then turned into a 30-60-90 day roadmap with budget, ROI timelines, vendor-neutral tool picks and a governance framework with security controls.

Deliverable: AI Strategy Blueprint with an executive presentation.

Scoped
fixed fee
Scope it →

AI Implementation & Integration

6–16 weeks

Solution architecture, configuration and workflow automation, data pipelines, testing and QA, and a phased rollout.

Deliverable: Production-ready AI system with documentation.

$45k–$180k
milestone billed
Scope it →

Fractional AI Leadership

retained

A senior AI lead who keeps the program improving after launch: monthly performance reviews, new use cases as you mature, vendor landscape monitoring, and AI governance and compliance oversight.

Deliverable: Monthly AI performance report and a quarterly strategy refresh.

$2k–$8k/mo
30-day notice
Scope it →
02

Cybersecurity & Risk Management

Cybersecurity Assessment

6–10 weeks

A posture assessment against NIST CSF, ISO 27001, DORA or NIS2, with maturity scored domain by domain and a multi-year roadmap to your target level.

Deliverable: Three-year roadmap and a detailed domain-level maturity report with recommendations.

$25k–$40k
fixed fee
Scope it →

Risk Assessments

scoped per assessment

Scoped technology risk assessments of applications, infrastructure and third parties, plus a review of your risk program's maturity: vulnerability management, threat intelligence and remediation strategy.

Deliverable: Risk list with detailed remediation recommendations for each risk and for the program.

Scoped
fixed fee
Scope it →
03

Audit & Compliance

Audit Support

per audit cycle

We coordinate SOX, SOC 2 and PCI DSS audits as the link between auditors and your technical teams, help control owners meet expectations, and run self-assessments to confirm readiness.

Deliverable: Findings with remediation steps agreed by each control owner.

Scoped
fixed quote
Scope it →

IT Compliance

readiness to implementation

Readiness assessments, pre-assessment audits and implementation for CCPA, DPDPA, FFIEC, GDPR, HITRUST and NYDFS, and alignment with ISO 27001, CIS Controls, NIST frameworks and SOC 2.

Deliverable: Periodic progress reports and a plan of action.

Scoped
fixed quote
Scope it →
04

CISO as a Service

Fractional CISO

retained

Senior security leadership, governance and board reporting without a full-time executive hire. Covers program maturity, risk management, HIPAA, PCI-DSS, SOC 2, CMMC and CCPA compliance, policies, vendor risk, incident response and tabletop exercises, awareness training, architecture review and cyber insurance support.

Deliverables: maturity roadmap, risk register, a 12–15 policy library, incident response plan, audit prep and monthly board-ready posture reports.

$4k–$14k/mo
30-day notice
Compare tiers ↓
8–12 hrs / month

Strategic Advisor

  • Policy review
  • Quarterly risk assessment
  • Board reporting
  • Compliance guidance
20–30 hrs / month

Active Leader

  • Full security program management
  • Vendor oversight
  • Incident response lead
  • Team mentoring
40+ hrs / month

Embedded Executive

  • Acts as your CISO
  • Regulatory interface
  • Audit management
  • Security team leadership

All tiers fall within the $4k–$14k/mo range and are quoted on your scope. Cancel with 30 days' written notice.

05

Cloud (AWS)

Cloud Readiness Assessment

3–6 weeks

A review of your current environment, with required controls mapped into the target-state plan and roles and responsibilities defined in a RACI matrix.

Deliverable: Current state, migration strategy and a high-level migration plan.

$10k–$25k
fixed fee
Scope it →

Cloud Migration & Setup

4–12 weeks

End-to-end migration to a secure, cost-optimized AWS environment: landing zone, networking, identity and security baseline, migration waves with rollback, backup and DR. AWS bills your own account with no resale margin.

Deliverable: Documented AWS environment, architecture diagrams, cost model and runbooks.

$35k–$120k
fixed fee or T&M
Scope it →
How we price

Three rules we don't break.

01

Fixed fee on anything we can define

Assessments, roadmaps and migrations are quoted as one number with milestones. Hourly billing is only for support work you choose to keep open-ended.

02

Your cloud bill isn't our margin

AWS is billed to your own account at your own rates. We take no resale margin and no vendor commission, which is why our recommendations stay vendor-neutral.

03

Every deliverable is a document you keep

Policies, diagrams, cost models and runbooks are yours, readable without us and portable if you leave.

About us

Enterprise-grade capability, sized for SMBs.

Who we are

A specialized managed services firm delivering AI-first technology solutions tailored for small and mid-sized businesses.

Our mission

To democratize enterprise-grade AI, cybersecurity and cloud capabilities so every business can compete, grow and thrive.

Our reach

We serve SMBs across healthcare, finance, retail and professional services.

Our approach

Consultative, vendor-agnostic and outcome-driven. We align technology to your business goals, not the other way around.

Questions

Before you ask for a number.

If yours isn't here, the discovery call answers it in thirty minutes.

Book the discovery call
Why ranges instead of a fixed price?

Because the honest number depends on how many systems are in scope, which framework you're audited against, how much your own team can absorb, and how fast you need it. The ranges are real, and you get a fixed written quote before you sign anything.

Is the discovery call really free?

Yes. Thirty minutes with a senior advisor, no invoice and no sales deck. If we're not the right fit, we'll say so on that call.

Is there a lower-cost way to start with AI?

Yes. We offer a lighter, lower-cost version of the AI Readiness Assessment that gives you a scorecard and a short list of opportunities. It can be expanded into the full assessment later.

Can we start with one practice and add the others later?

That's the normal path. Most clients start with an assessment or a migration, then add a CISO or AI leadership retainer once there's a program to run.

What happens if scope changes mid-engagement?

We re-quote the change in writing before doing the work. Milestones already delivered stay at the agreed price.

Do you work with companies under 50 people?

Yes. Smaller teams usually begin with the AI Readiness Assessment or a Strategic Advisor CISO retainer rather than a full migration.

How does a retainer get cancelled?

Thirty days' written notice, any month. You keep every policy, diagram and report produced up to that point.

Let's scope your systems, obligations and bandwidth.

Thirty minutes, no deck. You'll leave knowing which practice to start with, roughly what it costs, and whether the honest answer is "not yet". Ask for the full rate card here too.

Tell us how we can help. Our team will review your request and respond using your preferred contact method.

Open form in a new tab ↗