We are a 4-person cybersecurity consultancy — is our service packaging and pricing model wrong?

We were stuck in the exact same spot with our 3-person team. We walked away from one-off tests and signed local mid-sized finance and logistics firms on 2,000 GBP/month monitoring and audit retainers. We're currently sitting at 12 clients, bringing in 24,000 GBP a month in steady income, so we can focus on the work instead of stressing about next month.

You need to phase this in gradually. 1) First, call every client you did a pentest for over the past year. 2) Pitch a quick follow-up review: "You patched the issues we found, but have new risks emerged in the last 6 months?" 3) Attach a monthly retainer proposal to the end of that review that includes 4 scans a year.

Be careful when moving to a retainer model. SMBs hate paying recurring security fees; they usually only find budget when there's an active breach or an impending compliance audit. Unless you can offer compliance documentation that lowers their insurance premiums or helps them close deals rather than just handing them technical reports, selling retainers is going to be an uphill battle.

To prevent scope creep, make sure you strictly require these 3 clauses in your contracts: 1) The list of IPs and domain names included in the project scope is frozen; any new assets are subject to additional billing. 2) Post-report re-validation testing is limited to a maximum of 1 round. 3) Any revision requests not closed within 14 days following the delivery of the report are deemed complete.

hourly billing kills consulting. the faster you solve it the less money you make, its literally a perverse incentive. put together fixed-scope packages and lock them into monthly retainers save yourself the headache.

edit: I wrote something wrong above, sorry about that.

Supply chain regulations and enterprise audit standards are steadily tightening in the UK market. Instead of selling direct technical scans to your clients, you will have a much easier time getting monthly retainer fees approved if you sell the promise of ensuring the security posture they need to qualify for enterprise tenders.

In our first year we did a penetration test for an e-commerce client for 4,000 pounds. For the next 8 months, they called us every single time they moved a server asking "could you take a quick look?", we couldn't say no, and it almost ran us into the ground. Then we drew a hard line and offered either a 1,200 pound monthly retainer or hourly billing—they gladly took the retainer.

Sell the client the risk you eliminate and their peace of mind, not the hours you spend; the moment you tie your price to an hourly rate, your stopwatch becomes the subject of negotiation not your technical expertise.

edit: fixed a few typos.

There's one point I'm curious about. Hasty decisions become decisions you have to fix six months later.

Changing habits is harder and more expensive than setting up a system.

I went through the same thing two years ago. The biggest time-waster for us was not knowing who had the final say.

Of course, it varies if your situation is different.

Timely topic. Mistakes made on the cybersecurity consultancy side are usually reversible but expensive.

The harder it is to reverse a decision, the slower you should make it. If I were you, I'd go this route.

I agree with this. Most time waste accumulates in tasks waiting for approval.

If it's your first time, start small; scaling comes later. Hope this helps.

Let me speak from the other side; I'm on the supplier side. When making decisions, write down the worst-case scenario too, not just the best.

If I were you, I'd go this route.

we need to make a distinction here then annyway when we decide without measuring we always end up in the same place.

this is my opinion, I'm not claiming it's absolute truth.

I was thinking the same thing. If it's your first time, start small; scaling comes later.

This is my opinion, I'm not claiming it's absolute truth.

I'm writing this so you don't make the same mistake. People defend habits, not processes. Resistance comes from there.

Start with a small trial; don't commit to everything at once. Proven by experience.

Here's how it went for us. Look where the bucket leaks; pouring water on top doesn't solve it.

Hope this helps.

Just a heads-up. When making a decision, first look at what data you have on hand.

Everything goes well for the first three months; problems arise in the fourth. Of course it varies if your situation is different.