Expert-led assessment · from $2,500
The Zero Trust Completeness Audit
Your identity programme can tell you who is asking for access. Almost nothing tells you whether the infrastructure underneath them can be trusted. This is a fixed-price assessment that answers it — with a scored gap list and a plan, not a verdict.
No deployment required. No procurement cycle. The fee credits against a subscription.
What is required, and who supplies it
Seven criteria — and an honest column for your side of it
These are SAUTERA's own ITA completeness criteria, aligned in spirit to NIST SP 800-207 and the CISA Zero Trust Maturity Model. The third column is the one most vendors leave off.
| Criterion | What is required | What SAUTERA does | What you supply |
|---|---|---|---|
| C1 Continuous scoring is actually running | Evidence that infrastructure trust is assessed continuously, not at a point in time. | Counts real assessments across your estate in the last 24 hours and shows the cadence. | Nothing — this is measured directly. |
| C2 Coverage spans more than one scope | Assessment reaching hosts, services and cloud resources — not just endpoints. | Observes Windows and Linux hosts, services, and AWS resources across eight resource types. | Read-only access per scope you want covered. |
| C3 Confidence is adequate | Assessments that are actually reliable, with weak signal declared rather than averaged away. | Scores confidence per assessment and reports Unknown where coverage is thin. | Credentials sufficient for configuration read, not just inventory. |
| C4 Trust distribution is healthy | A portfolio view showing what proportion of the estate can be trusted, and why the rest cannot. | Scores every entity and attributes the untrusted ones — end-of-life software cannot score trusted. | Nothing — this is measured directly. |
| C5 Enforcement is configured | The trust verdict has somewhere to go — a policy enforcement point that can act on it. | Integrates with your existing enforcement point and records what was decided. | An enforcement point, and the decision to connect it. SAUTERA does not enforce in line. |
| C6 Attestation is active | Assessments that are independently verifiable rather than merely asserted by the vendor. | Provisions a signing key and signs assessments so a third party can verify them. | Enable signing after enrolment — the most commonly missed step. |
| C7 The audit trail is intact | A tamper-evident record an assessor can read, with no gaps. | Writes every finding, decision and approved remediation to an append-only record. | Nothing — this is measured directly. |
Where coverage is thin, the assessment reports Unknown rather than guessing. That is deliberate. A report that quietly rounds uncertainty up to green is worth nothing to the person who has to rely on it.
What you receive
A scorecard, a gap list, and a sequenced plan
Not a slide deck. The deliverable is a document you can hand to a board, an auditor, or the engineer who has to fix it.
See it before you buy it
The sample completeness report
A worked scorecard on an illustrative estate. The outcome is CONDITIONAL — five of seven criteria pass, because a sample that passes everything demonstrates nothing. The scoring, the summary and the remediation list were produced by the same engine that runs against a live tenant.
Fixed price
Three engagements
Priced, published, and fixed before we start. You will not receive an hourly invoice.
Express
$2,500
About one day
Remote review · seven-criteria completeness scorecard · prioritised gap list · 45-minute readout.
Most chosen
Standard
$7,500
Three to four days
Everything in Express, plus evidence review, control-mapped findings, a sequenced remediation roadmap, and a written report.
Evidence Baseline
$15,000
Standard, plus deployment
Everything in Standard, plus a deployed tenant, a live-scored baseline on your real fleet, and a 30-day re-check.
The fee credits against a subscription
100% of the fee credits against a first-year subscription signed within 90 days, capped at half that subscription’s first-year value. If you go forward, the assessment cost you nothing net. If you don’t, you keep the findings and the roadmap. You are not risking budget on a decision you have not made yet.
Read this part
What this is not
A company that sells honesty as a product feature has to be precise here, so we are.
This is an expert-led assessment, and nothing more than that. It confers no credential. It is not the independent, credential-granting review that a C3PAO or a SOC 2 auditor performs, and it does not satisfy any requirement that such a review has taken place. If you need that, you need an assessor authorised to grant it — this is the thing you do before that conversation, or instead of it if what you actually need is to know where you stand.
It also does not grade your Zero Trust programme. Most of what is measured is what SAUTERA observes about your infrastructure. SAUTERA completes the infrastructure half of a trust decision; it does not sit in judgement over the identity half.
Coverage is Windows and Linux today — not macOS, not mobile. Where there is no coverage, the report says so.
The paid engagement on this page is a human review and needs no deployment. The ITA Completeness Audit scorecard inside the product is a separate, included feature that requires a running tenant. We keep them apart on purpose.
How it runs
Four steps, and the first one is free
Scoping call — 30 minutes, no charge
We work out which engagement fits, or whether none does. Sometimes the answer is that you do not need this, and we will say so.
A one-page statement of work
Fixed price, fixed dates, named deliverables. No hourly drift.
The engagement
Express runs about a week from signature; Standard two to three.
The readout, and the report is yours
Whatever you decide afterwards, you keep the findings and the roadmap.
Start with the scoping call.
Thirty minutes, no charge, and it ends with a straight answer about whether this is worth your money. If you would rather see the product first, the free tier scores ten devices with no card.
Related: subscription pricing · what a compliance evidence package looks like · end-of-life exposure