Engagement Models
How a security retainer and a delivery retainer actually differ, stated plainly.
4 modelsand we will tell you which one you do not need
Security retainer vs delivery retainer
Two things called a retainer
Security retainers and software retainers are both called retainers and they behave nothing alike. A security retainer buys reserved capacity against an unpredictable need — you hope not to use the incident hours. A delivery retainer buys a standing team against a predictable need — if you do not use the capacity, you have wasted it. Blurring the two is how a client ends up paying for a dedicated squad to handle incidents that happen twice a year, or expecting an incident retainer to absorb a six-month build. This page exists so the distinction is clear before the commercial conversation, not during it.
Cybersecurity
Security retainer
- What it is
- Reserved capacity: testing days each quarter, incident hours, and advisory access. Priced on availability, because availability is what you are buying.
- What does an incident retainer actually reserve?
- Hours, a response time, pre-agreed rates, a pre-signed NDA, and a team that has already read your architecture. The last of those is the one that saves the most time in hour one, and it is the one you cannot buy during an incident.
Software Development
Embedded team
- What it is
- A standing squad on a quarterly commitment, working in your process, in your repository, in your stand-up.
- Do you work fixed price?
- For bounded work with a knowable scope, yes — tests, reviews, discovery phases. For a build, time and materials against a prioritised backlog with a cap and a monthly review, because a fixed price for an undesigned build is priced for the worst case and then spent defending the scope boundary.
The four shapes
What you can actually buy
Projects, programmes, retainers and embedded teams — and which of them you do not need.
Fixed-scope project
A bounded piece of work with a defined output: a penetration test, a cloud review, a discovery phase. Fixed price where the scope is genuinely knowable.
Programme
Multi-phase work with a defined destination — a certification, a platform uplift, a system replacement. Priced by phase, reviewed monthly.
Security retainer
Reserved capacity: testing days each quarter, incident hours, and advisory access. Priced on availability, because availability is what you are buying.
Embedded team
A standing squad on a quarterly commitment, working in your process, in your repository, in your stand-up.
All four, and we will tell you which one is wrong for you.
From first call to mobilised
How an engagement starts
Two to four weeks from first call to mobilised, faster for retainer clients.
Phase 1: Scoping call
60 minutesA technical conversation, not a qualification script. We establish what you are trying to achieve and what constrains it.
Phase 2: Proposal
3–5 daysScope, exclusions, timeline, team shape and price. Exclusions are stated in the body, not in an appendix.
Phase 3: Contracting
1–2 weeksMaster services agreement plus a statement of work. We will work under your paper. NDA before the scoping call if you prefer.
Phase 4: Mobilisation
1–3 weeksNamed team, kick-off, access provisioning, and the communication cadence agreed in writing.
Deliverables
Every proposal carries these
- A written scope with explicit exclusions
- A named team with named individuals, not roles
- An agreed communication cadence and escalation path
- Monthly commercial review on anything time-and-materials
Outcomes
- The right commercial shape for the actual need
- No surprise about what was excluded
- A named escalation path agreed before it is needed
Who you talk to
The commercial conversation
Varies by model — each proposal names the individuals.
Claire Benoit
Practice Director, Governance & Risk
Leads GRC and the vCISO practice, and has sat on both sides of an audit. Her standing position is that a control which exists only to be audited is a liability, and she will tell you which of yours those are.
Certifications
- CISSP
- ISO 27001 Lead Auditor
- CIPP/E
- PCI QSA
Related
Where each model applies
One firm, two practices, one backlog. The seam between build and break, removed.
Manual, evidence-led testing with criticals reported the hour they are confirmed.
Cybersecurity
Production systems with authorisation, audit and secrets handled properly from the first commit.
Software Development
24/7 detection and response on your telemetry, with detections written for your architecture.
Cybersecurity
Commercials
Shape, timeline and scoping
- Timeline
- Two to four weeks from first call to mobilised, faster for retainer clients.
- Team shape
- Varies by model — each proposal names the individuals.
- Engagement
- All four, and we will tell you which one is wrong for you.
- Scoping
- A named engineer replies within one business day. Scoping call within three. How the four engagement models differ.
Questions
Frequently asked
- Can we start with one test and expand?
- Most clients do, and it is the sensible order. A single test tells you whether you want to work with us before either side commits to a programme.
- Do you work fixed price?
- For bounded work with a knowable scope, yes — tests, reviews, discovery phases. For a build, time and materials against a prioritised backlog with a cap and a monthly review, because a fixed price for an undesigned build is priced for the worst case and then spent defending the scope boundary.
- What does an incident retainer actually reserve?
- Hours, a response time, pre-agreed rates, a pre-signed NDA, and a team that has already read your architecture. The last of those is the one that saves the most time in hour one, and it is the one you cannot buy during an incident.
- Can we buy security and software on one agreement?
- Yes, and it is the common case. One master services agreement, separate statements of work per engagement, one account team. The pre-release test is still signed by someone independent of the build.
Get started
Book a 60-minute scoping call
A technical conversation with the person who would lead the work — not a qualification script, not a discovery deck. You come away with a written scope, the exclusions stated in the body rather than in an appendix, and a day count that we have not padded.
A named engineer replies within one business day. Scoping call within three.
How a security retainer and a delivery retainer actually differ, stated plainly.
All four, and we will tell you which one is wrong for you.