Cloud misconfiguration review
800+ checks across AWS, Azure, and Microsoft 365 — with prioritized findings and compliance-mapped remediation guidance, not checklist-order busywork.
A posture review across AWS, Azure, or Microsoft 365, with prioritized remediation guidance mapped to CIS, SOC 2, NIST, and more. Delivered fast.
800+ checks across AWS, Azure, and Microsoft 365 — with prioritized findings and compliance-mapped remediation guidance, not checklist-order busywork.
A plain-English memo your board and customer-security team can read — with remediation tied to specific CC controls.
A ready-to-import Jira or Linear export. Each ticket has a severity, owner, and a one-paragraph fix description.
We agree what's in scope, who owns remediation, and who sees the final report. No sales call.
Short-lived IAM roles or M365 app registrations. You control the grant window and can revoke any time.
Every check runs across your environment. Ethan reviews every finding by hand — no AI-generated summaries, no false positives left in.
Prioritized findings, compliance memo, and a tracked Jira/Linear backlog. Two 45-minute walkthrough calls included — we walk you through your portal and report, not fix your stack.
Each environment (AWS org, Azure tenant, or M365 tenant) beyond the first adds $1,500 to the assessment and $500/month to the retainer. Pricing is the same regardless of which platform — we don't charge a premium for Azure or M365.
No. The assessment is a complete one-time deliverable; if you only want a point-in-time report, that's the whole engagement. The retainer is recommended because security drift is real — half of customers add it after the readout call so they have continuous portal access and quarterly rescans.
If your environment processes PCI cardholder data or HIPAA PHI, we add $2,500 to the assessment to cover the additional scope-definition work (carving out the CDE for PCI, BAA-aligned controls for HIPAA), liability premium, and HIPAA-specific control mapping. Once you're a customer, the surcharge applies to each new engagement that involves regulated data.
The PQC readiness module produces a crypto inventory across your environments — algorithms in use, harvest-now-decrypt-later exposure, vendor PQC posture, and a NIST FIPS 203/204/205-aligned migration timeline. Bundled with the base assessment is $6,500 per environment; standalone (no base assessment) is $12,500. Most enterprise security questionnaires now ask about PQC — this gives you a credible answer.
Assessments: 50% on signing, 50% Net-15 from report delivery. Retainers: monthly invoice (pay by ACH, wire, or card), or annual prepay for a 10% discount. We send invoices via Mercury; quotes valid for 30 days from issue date.
Founding-client rate (25% off the assessment + 50% off Year 1 retainer) is offered to the first 3–5 paying customers in exchange for a written testimonial and an anonymized case study. After that, we negotiate sparingly — better to keep transparent pricing for everyone than to play discount games.
Crestline does not perform remediation execution. We deliver findings, prioritization, compliance mapping, and advisory walkthroughs; your engineering team or your MSP partner ships the fixes. We can refer you to remediation partners if needed.
Most startups don't have a security problem. They have a security timing problem. The controls come too late, after the failed audit, after the lost deal. We exist to fix the timing.Ethan Leinberger · Founder, Crestline Security
Ethan Leinberger founded Crestline Security after a decade building and breaking cloud infrastructure — sometimes both on the same project. Crestline is the firm I wished existed when I was a startup engineer staring at a security questionnaire I had a week to answer.
Every Crestline assessment is delivered by me. Every report is reviewed by me. There are no junior consultants reading a runbook to your scan output. That ceiling is also the floor: I don't take more engagements than I can deliver carefully, which is the trade-off — slower onboarding, higher quality.
The platform itself — scan engine, AI analysis, portal, compliance overlays for SOC 2 / NIST / FedRAMP / HIPAA / PCI / NIS2 / FFIEC / CSA CCM — is built and maintained by me. Source is on GitHub; LinkedIn here.
For PCI / HIPAA engagements, additional scope-exclusion contract language and a signed Business Associate Agreement (BAA) are included; the AWS BAA covers our infrastructure-side processing.
We do best with teams that have shipped a real product and have customers asking security questions.
We'd rather tell you up front than waste a scoping call. Here's when we'll pass and refer you elsewhere.