Engagement catalog 2026 scope

One flagship engagement. Five orbital ways to start.

Olympus is the firm's flagship: a continuous application-security service that runs a closed agentic loop inside your tenancy. Most clients arrive on Olympus through one of five orbital engagements — an audit, a red team, a board-level read on AI exposure, a one-off code review, or an incident. Every engagement begins with a seventy-two-hour scope conversation and ends with a written attestation. There is no slideware in between.

Olympus  ·  The flagship

Continuous application security, delivered as a closed loop.

Mill Creek operates Olympus inside your tenancy under a named partner engagement. The loop is the offering: three sprites running continuously against your codebase, with monthly attestation to your audit committee and a four-hour incident response SLA bundled in.

We do not stop at advisories. Vulcan ships the pull request.

  1. Adversarial reconnaissance

    Nemesis

    Continuously probes your sanctioned agents, integrations, and tool-use surface. Operates at machine pace; reports with replayable evidence and tool-call provenance. Tenant-scoped — never leaves your VPC.

  2. Source-aware audit

    Delphi

    A multi-agent council that reads your code against your policy library, grades findings by impact and likelihood, and drafts the remediation plan. Each finding lands with a named human owner.

  3. Pull request, not advisory

    Vulcan

    Drafts the actual code, IAM, and policy changes that close the finding. Opens a pull request like any other contributor; your engineer reviews and merges. The diff is preserved with the finding. Rollback plan attached.

Scope
Continuous coverage of your application security surface — agents, integrations, browser tools, document pipelines, and the source repositories that compose them. Quarterly recalibration of the policy library with your CISO.
Engagement
Twelve-month commit. Thirty-day exit window each quarter, with no reason required. Comes online inside ten business days of signing.
Fee posture
Monthly retainer. Tiered against monitored surface area; published rate card available on request. Incident response bundled at four-hour SLA.
Engagement lead
Partner-led. Named CIO Council seat assigned for the duration of the engagement. Reachable to your CIO and VP Engineering throughout.
Deliverables
Continuous loop coverage, monthly attestation to the audit committee, quarterly policy-library review, replayable evidence per finding, four-hour incident-response SLA.

We say yes to

Engineering organizations whose application surface is now too large to be a once-a-year project. Boards that want a written security signal between audit cycles. CTOs willing to merge security PRs at the same cadence as feature work.

We say no to

Replacements for an in-house security team. Engagements where the goal is to reduce headcount rather than to raise the floor. Codebases the engineering team is not prepared to refactor against findings.

Visit Olympus in operator view → Request the Olympus brief →

Tier I

Entry-point engagements.

Three scoped engagements that often convert into Olympus adoption. For boards and engineering leaders who want a tested read before committing to the recurring service.

Tier II

Standing services.

Two services we offer alongside Olympus and as standalone engagements. Both are bundled at preferred terms for Olympus clients.

Selected work

Three engagements, anonymized.

Specific clients and figures are withheld pending publication consent. Each item below is structured the way the eventual named write-up will be: situation, intervention, outcome.

  1. U.S. health system  ·  50,000+ employees

    A clinical-coding agent with broader authority than anyone realized.

    Situation. A clinical-coding agent had been quietly extended with read access to a patient-facing scheduling system. The change was made under an existing approval; nobody escalated it.

    Intervention. Mill Creek ran the two-week posture audit. We mapped the agent's effective authority, not its declared authority. The gap was twenty-six integrations wide.

    Outcome. Authority reduced to the eight integrations the owner could justify on the call with the audit committee. Client moved to Olympus in the same quarter; first month's attestation went to the audit committee on schedule.

  2. Federal civilian agency  ·  mission-side

    A red-team engagement that changed the procurement language.

    Situation. The agency was about to procure an agentic case-management product. The security team had concerns but no leverage in the procurement conversation.

    Intervention. Mill Creek ran a four-week adversarial sprite engagement against a vendor demo environment. Replayable evidence of three exploitable behaviors.

    Outcome. Procurement language amended to require contractual remediation of all three. The vendor accepted. The procurement closed.

  3. Global asset manager  ·  AUM mid-eleven figures

    A four-hour response that did not become a regulatory event.

    Situation. An Olympus client paged Mill Creek when a research-summary agent began posting drafts to the wrong distribution list. Possible material non-public information exposed.

    Intervention. Partner on call within seventeen minutes. Containment by hour three. Forensic evidence preserved to the standard the firm's counsel had set in advance — captured automatically by Olympus during the loop.

    Outcome. Disclosure not required under the firm's regulatory framework. Internal review concluded inside the same business day. Olympus engagement renewed.

Selection criteria

We say no to more engagements than we say yes to.

Our reputation is the only asset that compounds across engagements. We protect it by being explicit about the work we will and will not take.

We say yes to

  • Engagements with a named executive sponsor at CIO, CISO, or VP Engineering level.
  • Production agents handling regulated data, customer communications, or code execution.
  • Boards with a written deadline for a tested risk narrative.
  • Engineering organizations willing to merge security pull requests at the same cadence as feature work.
  • Work where senior counsel and engineering are both in the room.

We say no to

  • Procurement-led RFP responses without an executive sponsor.
  • Engagements where the deliverable is a deck, not evidence.
  • Tests we cannot agree the boundaries of in writing.
  • Work where the ask is to validate a decision already made.
  • Anything that requires us to disparage a named competitor.

Standing order

Tell us which engagement is yours, or tell us none of them is.

The forty-five-minute briefing is run by a partner, under non-disclosure, and ends with a written read on whether the fit is Olympus, one of the orbital engagements, a different conversation, or no engagement at all. We hold a small number of intake slots each month for board-sponsored work.

Schedule the brief desk@Mill Creek.example