Retainer pricing locks in recurring revenue and keeps clients committed to ongoing security improvements—a win-win in an industry where threats evolve faster than annual assessments can keep up. Unlike one-off engagements, retainers let you forecast cash flow while your clients get predictable budget allocation. Here's how to structure and sell retainer models that actually stick.
Why Retainers Work for Security Services
Annual penetration tests miss the gaps between assessments. New vulnerabilities emerge weekly. Clients who switch to retainer-based engagement get continuous monitoring, quarterly assessments, and rapid remediation support—all on a predictable monthly bill. For your business, retainers eliminate the feast-famine cycle of project work and create predictable recurring revenue (MRR).
Retainers also reduce sales friction. Once a client commits, you're no longer competing on price every engagement cycle. You're a trusted partner, not a transaction.
Structuring Your Retainer Tiers
Build at least three tiers so clients self-segment by company size and risk profile:
- Starter ($2,500–$4,500/month): Quarterly vulnerability scans, monthly patch management reviews, email support. Target: SMBs with 50–200 employees, non-regulated industries.
- Professional ($5,000–$9,000/month): Monthly vulnerability assessments, bi-annual full penetration tests, 24-hour incident response support, compliance reporting (SOC 2, PCI-DSS templates). Target: mid-market companies, light regulatory requirements.
- Enterprise ($10,000–$25,000+/month): Continuous red teaming, monthly pen tests, dedicated security engineer, 2-hour response SLA, threat intelligence feeds, custom compliance frameworks. Target: large enterprises, healthcare, finance, government contractors.
The key: each tier includes something every month. Idle retainers die fast. Scope creep is the silent killer—define what's in-scope and out-of-scope per tier before a client signs.
Pricing Tactics That Stick
Lock in upfront commitment. Require 12-month agreements with a 10–15% discount on month-to-month pricing. A client paying $5,500/month retains stronger than one on a rolling basis—less churn, predictable revenue.
Bundle compliance reporting. Clients in regulated industries (finance, healthcare, SaaS) will pay 20–30% premium for monthly compliance reports, automated vulnerability tracking dashboards, and audit-ready documentation. This becomes table stakes for Enterprise tier.
Add optional add-ons. Offer security awareness training ($500/month), threat modeling sessions ($1,500 per engagement), or incident response drills ($3,000 per quarter) as separate line items. Many clients add these after 3–6 months.
Tiered response SLA. Starter tier gets 48-hour response; Professional gets 24-hour; Enterprise gets 2-hour. Clients paying Enterprise rates will pay extra to know a human is checking alerts.
Getting Clients to Convert
Don't pitch retainers cold. Start with a limited engagement: a one-off vulnerability assessment (typically $3,000–$8,000) or a week-long pen test. During the engagement, identify follow-up work and vulnerabilities that require ongoing monitoring. When you present findings, propose the retainer as the way to handle remediation.
Example close: "We found 47 vulnerabilities. Remediating and validating fixes will take 8–10 weeks. A Professional retainer at $6,500/month gives you monthly assessments to confirm each patch works and catch new issues—that's two months of security certainty for $13,000."
Clients hear ROI, not cost.
Operational Reality
Budget 60–80 billable hours per month per Professional-tier client. If you underestimate hours, retainer margins collapse. Track every engagement meticulously; bloat kills profitability.
Use a PSA tool (Jira Service Management, Kantata, Mavenlink) to cap scope and log hours. Many retainer failures stem from poor time tracking, not poor pricing.
Getting Found
Building retainer packages is one thing—landing the clients who'll sign them is another. Listing your penetration testing and vulnerability assessment services on Mercoly helps you get discovered by business owners actively seeking ongoing security partnerships, not one-off tests. Your retainer tiers become searchable, leads come pre-qualified, and you close faster.
Frequently Asked Questions
Q: Should I offer monthly or annual retainer pricing? A: Offer both. Annual prepay (10–15% discount) locks in cash flow and reduces churn; monthly retains flexibility for price-sensitive buyers. Most pen test firms see 70% annual, 30% month-to-month.
Q: What happens if a client runs out of in-scope work during a retainer month? A: Document it. If scope is genuinely exhausted in month two of a 12-month contract, add a credit to the next month, expand scope, or offer a lower-tier retainer. Overstuffing retainers to justify hours creates resentment and early cancellations.
Q: How do I prevent scope creep on a retainer? A: Write a Statement of Work detailing what's included (e.g., "up to 40 hours/month of assessments and remediation support"), what triggers overage billing (e.g., $200/hour beyond 40 hours), and what's out-of-scope (e.g., custom application code review, emergency incident response). Make it one page; sign it.
Start with one retainer client this quarter—use them as your proof of concept before rolling retainers out to your entire pipeline.