A cyberattack hits somewhere in the world roughly every 39 seconds, and global cybercrime damage is now measured in the trillions. That fear is precisely why starting a cybersecurity business can be commercially sound: organisations cannot hire fast enough to cover the gap, so they outsource instead. But a firm with strong technical skills and weak pricing discipline still fails, because undercharging for assessments, retainers and managed services quietly drains the margin that keeps the lights on.
This article sets out how to price a cybersecurity consulting business so that revenue growth actually turns into profit, not just busier invoicing. If you are weighing up services, segments and rate structures before you register the company, working through your numbers alongside a winning financial plan will give you a clearer starting price than guesswork ever will.
What Should Your Firm Sell, and to Whom?
Your firm should sell one or two clearly defined services to a client segment with an urgent, specific reason to buy, rather than a broad menu aimed at anyone with a security budget. Market research into the cybersecurity market shows buyers rarely purchase proactively; they act because a customer sent a security questionnaire, an insurer asked a question they could not answer, or a regulator set a deadline. Matching your service to that trigger determines whether your pricing lands as fair value or as a hard sell.
Which Client Segments Have a Specific Reason to Buy?
Healthcare organisations buying against HIPAA, payment processors facing PCI-DSS penetration testing mandates, and SaaS companies chasing SOC 2 to close enterprise deals are the clearest buyers. Defense contractors need Cybersecurity Maturity Model Certification. EU-facing firms need GDPR and, increasingly, DORA compliance if they touch financial services. Each of these client segments has a deadline attached, which makes the sale far easier than pitching generic risk reduction.
Which Services Can You Deliver Credibly at Launch?
Security assessments, vulnerability assessments and penetration testing have the lowest barrier to entry: a solo cybersecurity consultant with the right certifications can deliver these without staff. Compliance consulting, including SOC 2 readiness and ISO 27001 readiness, is knowledge-based and scales well once you have a repeatable methodology. Security architecture work and full managed security service provider delivery require more infrastructure and are better suited to firms with a small team.
When Should You Offer Consulting Rather Than Managed Security?
Offer consulting when the job is to assess, build or prove something with a defined end point, such as a risk assessment or a compliance audit. Offer managed security, delivered as an MSSP or a virtual CISO arrangement, when the client needs ongoing accountability and monitoring rather than a one-off deliverable. Independent cybersecurity consultants typically start with project-based consulting and add managed services once they have the staffing to support 24/7 commitments.
Which Credentials Help Establish Trust?
CISSP, CISM and CISA are baseline credibility markers for advisory and compliance work, while CompTIA Security+, CEH (Certified Ethical Hacker) and OSCP carry particular weight for technical assessments and penetration testing. Enterprise procurement teams often list specific certifications as a vendor qualification requirement, so their absence creates friction even when your actual delivery is sound. Certifications also directly support higher billing rates, since clients use them as a proxy for risk when they cannot assess technical depth themselves.
How Do You Calculate a Profitable Minimum Price?
A profitable minimum price covers your fully loaded delivery cost per billable hour plus a target margin, not just the time you spend in front of the client. Most new cybersecurity consulting firms underprice because they calculate cost from salary alone and ignore insurance, tools, non-billable hours and the certifications that got them in the room. Getting this number right before your first proposal protects you from quietly funding client work out of your own pocket.
What Will It Cost to Open and Operate the Firm?
Startup costs for a lean cybersecurity consulting practice typically run from a few thousand dollars for certifications, a basic lab environment and business registration, up to tens of thousands if you are building a managed service offering with licensed security tools. Ongoing annual costs include professional liability insurance and cyber liability insurance, both of which clients increasingly ask to see evidence of before signing. Continuing education, conference attendance and tool licensing (Kali Linux, Burp Suite, vulnerability scanners) are recurring costs that need to sit inside your pricing, not outside it.
How Many Hours Can You Realistically Bill?
A solo consultant working full-time rarely bills more than 60 to 70% of their hours once you account for proposals, admin, marketing and non-billable client communication. If you assume 100% utilisation when setting your hourly rate, every hour you actually bill has to absorb the cost of every hour you cannot. Building your rate from a realistic billable-hours assumption, rather than a theoretical 40-hour week, is the single most common correction new founders need to make.
How Do You Calculate a Price Floor and Gross Margin?
Add your fully loaded annual costs (salary draw, insurance, tools, overhead) and divide by realistic billable hours to get your cost per hour. Your price floor needs to sit above that figure by your target gross margin, commonly 40 to 60% for established service firms, before you factor in market positioning. If you want a structured way to work this through, a breakeven analysis will show you exactly how many billable engagements you need each month before the business turns a profit.
Which Costs Require Regular Price Reviews?
Tool licensing, cyber liability insurance premiums and subcontracted specialist time (such as a senior penetration tester brought in for a larger engagement) all shift over time and erode margin protection if left unreviewed. Client complexity also changes your real cost to serve: a client with three subsidiaries and a mixed cloud and on-premise environment costs more to assess than a single-tenant SaaS company, even under the same service name. Review pricing at least annually, and immediately after any engagement that ran significantly over your estimated hours.
Which Pricing Model Fits Each Service?
Fixed fees suit one-off, clearly scoped work, while retainers and per-unit pricing suit ongoing services, and the two should rarely be mixed within a single engagement. Matching the pricing model to the delivery structure is what separates a cybersecurity consulting firm with predictable margins from one that bleeds hours on every project.
When Should Assessments and Penetration Tests Have Fixed Fees?
Security assessments, vulnerability assessments and penetration tests are well suited to fixed fees because the scope, duration and deliverable are defined upfront. A small-environment assessment typically runs two to four weeks; pricing it as a fixed project fee gives the client budget certainty and protects you if the work finishes early. Build retesting into the fixed fee explicitly, since excluding it is the most common way firms quietly shrink the headline price and then invoice extra later.
How Should You Price vCISO and Compliance Retainers?
Virtual CISO (vCISO) services and SOC 2 or ISO 27001 compliance work are best priced as monthly retainers, reflecting the ongoing accountability the role carries rather than discrete deliverables. Retainers give you predictable revenue and give the client a named point of accountability, which is precisely what buyers at CEO and board level are purchasing. Define the scope of what the retainer covers (hours, response times, deliverable cadence) in writing, because retainers are the pricing model most often underpriced once scope creep sets in.
What Is the Right Billing Unit for Managed Security?
Managed security service provider pricing works best on a per-user or per-device monthly fee, tiered by service level: basic monitoring, standard with vulnerability scanning and threat intelligence, and premium with 24/7 SOC monitoring and incident response. SIEM, EDR and MDR services layered into a premium tier justify a materially higher per-seat price because the underlying cost to deliver (tooling, analyst time, response commitments) is genuinely higher. Choose the billing unit that matches how the client experiences value: per-user pricing fits workforce-driven risk, while per-device fits endpoint-heavy environments.
When Does Variable Work Require Custom Pricing?
Incident response and threat hunting engagements resist fixed pricing because the scope is unknown until the investigation starts. Price these with a retainer that guarantees a response window, supplemented by time-and-materials or day rates once the engagement begins. Value-based pricing can apply here too: a firm that demonstrably shortens detection time or contains a breach faster can justify a premium over a firm quoting on hours alone.
| Service | Typical pricing model | Typical range |
|---|---|---|
| Penetration test | Fixed fee | $4,000-$30,000 |
| Vulnerability assessment | Fixed fee | $3,000-$15,000 |
| SOC 2 / ISO 27001 readiness | Fixed fee or phased milestones | $12,000-$70,000 |
| Virtual CISO | Monthly retainer | $3,000-$15,000/mo |
| MSSP (per user/device) | Tiered subscription | $15-$75/user/month |
| Incident response | Retainer plus time-and-materials | $5,000-$25,000/mo retainer |
How Do You Protect Profit from Proposal to Renewal?
Profit is protected by a tightly written statement of work, a disciplined approach to early discounting, and a clear plan for when to add headcount or partners rather than stretching existing capacity. Many cybersecurity consulting firms price correctly on paper and still lose margin because scope drifts after the contract is signed.
What Must a Statement of Work Define?
A statement of work needs to name the specific environment in scope (single tenant versus multiple subsidiaries), whether retesting is included, the individual delivering the work, and what happens when the client requests additional items mid-engagement. Vague scope is the leading cause of quotes for identical work varying by a factor of five between firms. A clear SOW also protects you at renewal, since it gives you a documented baseline to compare against when the client’s environment has grown.
How Can You Win Early Clients Without Discounting Indefinitely?
Offer a free initial security posture review as a low-cost way to demonstrate value, then price the resulting remediation or compliance work at full rate. This works because it reduces the client’s risk of a first purchase without permanently anchoring your rate card low. Avoid open-ended discounts for “first clients” that carry into renewal; instead, cap any introductory pricing to a single engagement and state the standard rate in the proposal itself.
When Should You Hire, Partner or Expand Your Service Menu?
Hire or subcontract when demand for a service consistently exceeds your own billable capacity for more than a quarter. Partner with managed service providers who lack in-house cybersecurity expertise when you want referral volume without building a new delivery capability from scratch. Expand your service menu only after your current services are priced profitably and consistently delivered, since adding new offerings before fixing pricing on existing ones multiplies the problem rather than solving it.
Build a Firm Whose Prices Support Its Promises
A cybersecurity consulting firm earns trust through certifications, case studies and operating experience, but it stays in business through disciplined pricing. Know your fully loaded cost per billable hour before you quote anything, match the pricing model to how the client actually consumes the service, and write statements of work precise enough to survive scope creep. Review your numbers at least once a year, since tool costs, insurance premiums and client complexity all shift the price floor over time. Get the pricing structure right early, and the certifications, niche focus and client trust you build on top of it have something solid to stand on.
Frequently Asked Questions
How much money do you need to start a cybersecurity consulting firm?
A lean, solo cybersecurity consulting practice can launch for roughly $5,000 to $15,000, covering certifications, lab tools, business registration and a first year of liability insurance. A firm building managed security service capability with licensed monitoring tools and additional staff should budget significantly higher, often into the tens of thousands. Costs scale with the service model chosen, not with ambition alone.
Is a cybersecurity services business profitable?
Yes, cybersecurity services businesses can be highly profitable, with established MSSPs reporting gross margins of 40 to 60% once delivery is systematised. Profitability depends on pricing that reflects true delivery cost, including non-billable hours, insurance and tooling, rather than matching competitor rates without checking your own cost base. Recurring revenue models, such as retainers and subscriptions, tend to produce more stable margins than one-off project work.
How much should a new cybersecurity consultant charge?
New cybersecurity consultants typically charge $150 to $350 per hour for compliance and advisory work, and $1,500 to $4,000 per day for penetration testing, depending on certifications and market positioning. Rates should be calculated from your fully loaded cost per billable hour plus a target margin, not set by copying a competitor’s published rate. Certifications such as CISSP or OSCP support pricing at the higher end of these ranges.
Should a new firm charge hourly rates or fixed project fees?
Fixed project fees suit clearly scoped, repeatable work like assessments and penetration tests, since clients get cost certainty and you are protected if the job finishes faster than estimated. Hourly rates suit exploratory or open-ended work where the scope is genuinely unclear at the outset, such as early incident response. Most firms use fixed fees for defined deliverables and retainers for ongoing accountability roles like vCISO.
Can a solo consultant profitably offer managed security services?
A solo consultant can offer a limited managed security service, such as monthly vulnerability scanning or a vCISO retainer, but full 24/7 SOC monitoring generally requires at least a small team or a white-label platform partnership. Attempting full MSSP delivery solo risks missed response-time commitments, which damages client trust faster than most other service failures. Many solo practitioners build toward managed services by first establishing 3 to 5 anchor clients through project-based consulting.
Leave a Reply