Liability Ceiling Framework

Every security retainer carries an implicit liability ceiling: the gap between what an agency promises and what an attack surface can actually guarantee. Agencies that sell "we will keep you secure" absorb unlimited downside; agencies that sell defined detection, response, and remediation scopes cap their exposure while still charging recurring fees. The framework asks three questions before signing: what specific asset is protected, what detection window is promised, and who owns the residual risk when a novel attack path emerges. Cogent's VR-1 model maps attack paths across enterprise infrastructure, which reframes the deliverable from "prevention" to "path visibility," a bounded promise. Sentrint grades repository security and generates fix prompts, giving clients a measurable artifact rather than an assurance. Vaultak monitors and rolls back AI agent actions in production, another bounded scope. California SB 813 and AB 1405, signed September 9, 2026, formalize third-party AI audit expectations, which pushes agencies toward documented, auditable scopes instead of blanket guarantees.