How Cybersecurity Agencies Price Their Retainers
Five pricing variables explain why cybersecurity retainers range from thousands to millions.
Cybersecurity retainer pricing is genuinely confusing, and that confusion is not accidental. The word "retainer" gets applied to at least four completely different arrangements. An incident response retainer, an MSSP retainer, a vCISO retainer, and a cybersecurity marketing retainer share almost nothing except the billing model. Comparing quotes across those categories is like comparing a gym membership to a personal trainer to a nutritionist to a physical therapist. They all relate to health. They are not the same thing. Once you know which category you are actually shopping in, and which five variables drive the price inside that category, almost every quoted figure becomes readable. You can tell whether a number reflects genuine capability or well-packaged overhead.
Why the Market Got Big Enough to Support Premium Retainer Pricing
The global managed security services market hit $38 billion in 2025 and is projected to nearly double by 2033. That kind of growth happened because buyers ran out of alternatives.
Three things drove this:
Regulatory pressure. Frameworks like DORA and NIS2 in Europe moved security from a best-practice conversation to a legal obligation. You either have documented controls and response capacity, or you are non-compliant.
Cloud sprawl. Attack surfaces expanded faster than most internal teams could cover. The perimeter everyone used to defend basically dissolved.
A talent shortage that shows no sign of resolving. Experienced security practitioners are scarce and expensive. Agencies charge a premium for access to people that most organisations simply cannot afford to hire directly, or retain once hired.
Here is the part buyers often miss. For most organisations, this is mandatory spend. Cyber insurance carriers have made certain security arrangements effectively mandatory, and regulators in several sectors have done the same. The market grew because not spending stopped being an option.
What a Breach Actually Costs Is the Whole Ballgame
IBM's 2025 Cost of a Data Breach report puts the average breach cost at $4.88 million. Organisations with an IR retainer already in place cut that figure by $1.49 million on average. That one number explains most of the IR retainer market.
Sector exposure makes it sharper. Healthcare averaged $7.42 million per breach. Financial services averaged $5.56 million. The global average was $4.44 million. If you sit in one of those regulated sectors, your downside on a single incident is meaningfully larger than the median buyer's. Paying more for a retainer in that context is arithmetic.
There is also the insurance angle. Carriers increasingly require a DFIR retainer as a condition of coverage. Arctic Wolf's 2024 Cyber Insurance Outlook found that about a third of carriers required an IR plan or retainer, and roughly half of organisations with a comprehensive IR retainer in place saw premium savings of 10% or more. The retainer fee carries a service cost and an insurance cost, and buyers in high-exposure sectors should evaluate it on both terms.
What IR Retainers Are Actually Buying and Where the Cost Gap Comes From
IR retainers typically run between $10,000 and $100,000 per year. What that buys goes beyond hours. It buys a pre-negotiated relationship, pre-positioned tooling, legal agreements signed before anything is on fire, and a guaranteed response SLA. The difference is usually a two-to-four-hour response window with a retainer versus a twenty-four-to-seventy-two-hour window without one.
The rate differential is where the math gets clarifying fast:
Retained hourly billing: $175 to $400 per hour
Emergency billing for the same firm doing the same work with no retainer: $800 to $1,500 per hour
Run that out on a real engagement. A 500-hour incident response at emergency rates is $500,000. The same engagement at retained rates, plus a $30,000 annual retainer fee, lands around $180,000. That is a $320,000 gap on a single incident.
Ransomware remediation alone typically consumes at least 150 hours. Most mid-market organisations will blow past a standard prepaid hour block during any serious incident, which means the number of prepaid hours matters just as much as the annual fee. A practical baseline for a single-region engagement is 40 to 80 hours. Larger environments, or ones with prior breach history, should size up from actual data rather than guessing.
The Prepaid vs. Zero-Dollar Retainer Trade-off Almost Nobody Models Correctly
There are two main IR retainer structures, and buyers consistently underestimate the risk in both of them.
Prepaid retainers lock in a known annual cost. They also let you use hours proactively before anything goes wrong. Threat hunting, tabletop exercises, incident planning. That is genuinely valuable. The hidden risk is that organisations who do not use those hours on proactive work leave money on the table, and many under-buy out of fear of over-committing, which leaves them short when a real incident hits.
Zero-dollar retainers establish the relationship, the negotiated rate, and the legal framework without requiring any upfront hour purchase. You pay only when you engage. The hidden risk is that the negotiated rate and the priority access are only as reliable as the firm's capacity at the moment you actually need them. No prepaid commitment means no guaranteed resource reservation.
The right model depends on an organisation's incident history, internal security maturity, and tolerance for variable spend. Most buyers choose based on cash flow preference and call it a strategy. That is a cash flow decision, not a risk decision.
How MSSP Retainer Pricing Is Structured and Why the Range Is So Wide
Most organisations land somewhere between $2,000 and $25,000 per month for MSSP services. Large enterprises with complex multi-cloud environments spend significantly more, with some annual totals exceeding $1 million.
A useful benchmark: a 200-user organisation should model roughly $15,000 to $25,000 per month for a fully managed engagement. That is $180,000 to $300,000 annually before overages.
Per-user pricing varies a lot. A 2023 CompTIA survey found average per-user cybersecurity retainer pricing at $15 to $75 per month depending on service level. More recent market data puts base MSSP rates at $100 to $200 per user per month before incident fees or add-ons.
There are five pricing structures you will encounter:
Per-user or per-device pricing is easy to forecast and scales predictably with headcount.
Flat-rate monthly pricing offers the most budget predictability but locks scope very tightly.
Tiered or packaged pricing lets you buy up, but the tier boundaries are usually drawn to push you into the next level.
À la carte pricing feels flexible and tends to become expensive quickly when you actually need multiple services.
Usage-based pricing, usually tied to log ingestion volume, aligns cost to activity but can spike hard during an incident, which is exactly when you least want a surprise invoice.
Flat-rate structures protect your budget but constrain scope. Usage-based structures align incentives until they do not. Stress-test which model performs worse in a high-activity month before you sign.
Where Hidden Costs Accumulate in MSSP and vCISO Retainers
This is where most buyers get surprised. The headline monthly number and the actual annual spend are often meaningfully different.
For MSSP retainers, the common overage vehicles are incident response fees, remediation work, and out-of-scope advisory hours. These are the situations that trigger the retainer in the first place.
For vCISO retainers with strict hour caps, overages typically bill at $250 to $400 per hour. Compliance audits and formal assessments are almost always billed separately, usually in the range of tens of thousands of dollars depending on scope.
Before you sign anything, ask these questions directly:
What exactly triggers an out-of-scope charge?
Are audits, assessments, and tabletop exercises included or billed separately?
Do unused hours roll over or expire at the end of the month or quarter?
If an incident occurs mid-retainer, is the response work billed at the retainer rate or a different rate?
A provider that hedges on any of those questions is telling you something. The delta between a tidy monthly figure and your actual year-end invoice can be substantial, especially if you hit a bad month where an incident, an audit, and a scope expansion all land at once.
How vCISO Retainers Reflect Seniority, Regulatory Context, and the Alternative They Replace
Monthly vCISO retainers average between the low thousands and tens of thousands of dollars. Regulatory-sector engagements command a premium. Healthcare typically runs in the higher thousands to mid-teens thousands per month. Financial services, given PCI-DSS obligations, runs $10,000 to $16,000 per month. Entry-level fractional offerings start lower.
The comparison that justifies those numbers is the full-time alternative. A full-time CISO's total cost, including compensation, benefits, equity, and recruiting, typically lands between a quarter-million and half a million dollars a year. A $5,000-per-month fractional retainer is roughly one-fifth of that floor, and it can be operational in weeks rather than the months a full-time search requires.
Seniority matters more in this category than in any other. A vCISO retainer is priced on the claim that the practitioner can operate at board and executive level, navigate regulatory frameworks, and make defensible risk decisions. That claim stands or falls on the specific individual doing the work. Vague references to "our team" or "our bench" are not answers. Ask for the named practitioner and their actual background. Verifiable prior CISO-level roles. Explicit deliverables tied to the frameworks relevant to your sector. A defined escalation path if that person is unavailable.
An agency that cannot name the person and describe their prior roles is charging a seniority premium without the seniority to back it.
What Cybersecurity Marketing Agency Retainers Cover and How Their Pricing Reflects Scope
Specialist cybersecurity marketing agencies typically charge between $5,000 and $15,000 per month on retainer. Comprehensive enterprise programmes run above $20,000 per month. Full cybersecurity PR agency retainers run $15,000 to $45,000 per month. A funded Series B security company should expect to pay around $23,500 per month once analyst relations, crisis communications readiness, and media training are included, based on 2026 benchmarks.
A fractional senior operator covering the same strategic layer costs $5,000 to $12,000 per month. The trade-off there is bandwidth and production capacity; the quality of judgement can be comparable.
The variables specific to this category are:
Practitioner seniority and technical credibility. Can the team's output survive a review by a practitioner in the industry they are writing for? Cybersecurity buyers are sceptical audiences. Content that is vague or technically soft damages the brand it was supposed to build.
Whether original research is included. Research-driven content is more credible and more expensive to produce. Production-only content is cheaper and less defensible.
Deliverable-scoped versus time-and-materials. Deliverable-scoped retainers are easier to evaluate. Time-and-materials retainers in this category frequently generate overhead: billing for coordination, briefing calls, and revision cycles that do not produce publishable output.
Ask directly what the retainer produces per month, in concrete terms. Ask for a list of deliverables rather than a list of services.
The Five Variables That Explain Almost Every Quoted Retainer Figure
Across all four categories, pricing is driven by the same five inputs. If you can get clear answers on each of these, you can evaluate almost any quote.
Scope of coverage. What is included, what triggers an overage charge, and has that boundary been stress-tested against realistic scenarios. An incident mid-month. A compliance audit. A board-level request out of nowhere.
Practitioner seniority. The level of the individual doing the work, not the level of the firm's most impressive hire. In every category, price should reflect who is actually on the engagement.
Response commitments. Guaranteed SLAs with contractual consequences versus best-effort language. The two-to-four-hour versus twenty-four-to-seventy-two-hour gap in IR retainers is the clearest illustration, but the same principle applies to MSSP escalation paths and vCISO availability windows.
Regulatory and sector exposure. Healthcare, financial services, and government contracting buyers face higher baseline costs because their downside is demonstrably larger. A premium for those buyers reflects genuine risk calibration.
Pricing model structure. Per-user, flat-rate, usage-based, and prepaid-hours models each create different incentive alignment between buyer and provider. Misaligned structures generate the conditions for hidden cost accumulation regardless of what the headline figure says.
How to Read a Retainer Proposal and Spot Where the Number Is Real
Start with the scope boundary, not the monthly figure. A lower headline number with a narrow scope and aggressive overage rates often costs more in practice than a higher flat-rate figure with clear inclusions, and buyers routinely miss this.
Ask for named practitioners. In every category, seniority is the largest legitimate driver of premium pricing. Vague references to "our team" signal that the named talent is likely inaccessible at the retainer price.
Stress-test the response commitment language. "Best efforts" and "target response time" are placeholders, not contractual commitments. Look for contractual consequences for missed windows and ask what the escalation path is when the primary contact is unavailable.
Model the worst-case month. What does the bill look like if an incident hits, an audit is triggered, and the retainer's hour cap is exceeded simultaneously? A provider that cannot answer that question concisely is either under-scoped or avoiding the conversation about overage risk.
For marketing retainers specifically. Ask whether original research, technical review, and distribution are included or billed separately. The difference between a retainer that produces technically credible output and one that produces volume is buried beneath the pricing structure, which is the gap studios like Cyberou, a cybersecurity-only content shop that grounds its work in live threat intelligence, are built around. Ask directly.
The retainer market is large, it is growing, and a lot of the pricing is legitimate; a meaningful share is not justified. The variables that drive the real cost are knowable. A buyer who asks the right five questions before signing a proposal is in a significantly better position than one who negotiates the headline number without understanding what sits underneath it.
