Portfolio Program
One assurance model applied across three or more enterprise AI tools: prioritized sequencing, shared evidence where controls repeat, and portfolio-level reporting for governance forums. Mayhem Shield delivers findings and artifacts, not ongoing program management or vendor implementation for each product.
$60K to $150K
Typical range
8 to 12 weeks
Typical timeline
3+ tools
15-20% volume discount
Right for this program
Fits organizations with several AI tools in flight where isolated one-off reviews would duplicate effort and leadership needs a single assurance standard plus a clear review sequence.
- Three or more tools deployed or on the path to broader rollout
- Limited capacity to run parallel full-depth reviews per tool without a shared plan
- Shared identity, data, or integration surfaces where evidence can be reused when appropriate
- Steering forums want a portfolio risk narrative, not only per-tool status
- Volume economics: typically 15 to 20 percent lower than individual full reviews at comparable depth
Scope
Three or more tools reviewed under a unified delivery model. Shared controls assessed once and applied across all tools. Priority sequencing by risk, not alphabetical order.
- All tools classified by implementation category
- Overlays identified per tool and aggregated at portfolio level
- Shared control evidence applied across applicable tools
- Cross-portfolio integration surface assessed as a whole
- Governance roadmap and program operating model included
Deliverables
Platform classification - all tools
Implementation category and capability profile for every tool in scope.
Prioritized review sequence
Tools ordered by risk level for review. Highest-risk deployments reviewed first.
Unified findings tracker
Cross-portfolio tracker covering all tools with current and required state documented per review area.
Shared control evidence
SSO, DLP, SIEM, network controls, and integration surface assessed once and applied across all tools where applicable.
Cross-portfolio integration assessment
Data sharing, integration dependencies, and connector surfaces across tools assessed as a unified attack surface.
Portfolio-level risk summary
Aggregated risk posture across all tools with priority remediation recommendations.
Governance roadmap
Ongoing program model: review cadence, re-assessment triggers, governance ownership, and monitoring criteria.
Approval documentation per tool
POC, pilot, and production gate documentation for each tool, aligned to the unified review model.
How the program works
Eight to twelve weeks, three or more tools, unified assurance model.
8-12 weeks total
- Discovery call covering all toolsDay 0
Inventory all tools in scope, classify each by category and overlay, and identify the highest-risk items for priority sequencing.
- Portfolio scoping and prioritizationDays 1-5
Within 3 to 5 business days: priority order, shared control identification, timeline by tool, and fixed-price proposal.
- Engagement kickoffWeek 1
Unified document request, shared stakeholder plan, and cross-portfolio review schedule established.
- Sequential tool reviewsWeeks 2-9
Tools reviewed in priority order. Shared controls assessed once and applied across all relevant tools.
- Cross-portfolio integration assessmentWeeks 9-10
Integration and data sharing between tools assessed as a unified surface, not tool by tool.
- Portfolio risk summary and roadmapWeeks 10-12
Portfolio-level risk summary, governance roadmap, and program operating model delivered.
Pricing
$60,000 to $150,000
Based on number of tools and overlay complexity
- Starting price reflects three tools with moderate complexity
- Price scales with tool count and overlay distribution across the portfolio
- 15 to 20 percent volume discount versus individual review pricing
- Shared control assessment efficiency reduces per-tool cost
What expands the range
The portfolio range expands when tools include higher-risk overlays. Each overlay expands structured review coverage and effort per tool.
- Agentic execution across multiple tools
- RAG pipelines with different retrieval architectures
- Self-hosted or on-premises model infrastructure
- Regulated data (HIPAA, PCI, financial) across tools
- Broad connector and integration surface
Discovery calls take twenty minutes.
We confirm deployment fit, outline review scope, and match you to the right packaged offer. No engagement starts until you decide to proceed.