Learn
How to price and sell monthly security reports as a web agency retainer
Many agencies already patch plugins and renew certificates for clients as part of a care plan, and give the security part of that work away because it is invisible. A monthly security report makes it visible: what was checked, what was found, what was fixed, what is left. This guide is a framework for pricing that report as part of a retainer, with the costs to account for and an illustrative example you can adapt.
What the client is buying
Be precise about this before naming a price, because it sets what you can charge and what you are liable for.
- Assurance that someone is looking. A dated record, every month, that the site was checked from outside and maintained from inside.
- Prioritised action. Not a scanner dump: the two or three things that matter this month, and whether they are fixed.
- Evidence for others. Insurers, enterprise customers and payment providers increasingly ask small businesses what they do about security. A monthly report is an answer.
What it is not: a penetration test, a guarantee, or incident response. Say so in the proposal and on the report itself. Clients understand "we check for known issues and fix them"; they do not forgive an implied promise that the site cannot be hacked.
Your costs per site per month
| Cost | What drives it |
|---|---|
| Tools | Scanner subscription divided across sites, plus any security plugin licences. Usually the smallest cost. |
| Triage time | Reading the scan, reproducing new findings, dismissing false positives. Small when nothing changed; larger the first month and after big changes. |
| Fix time | Configuration fixes are quick; plugin replacements and CSP work are not. Decide whether fixes are included, capped or billed separately. |
| Reporting time | Writing the summary and the order of work. Near zero if the tool produces a client-ready report; an hour or more if you assemble it by hand. |
| Client communication | Sending, explaining, answering questions. Easy to forget, rarely zero. |
Three ways to package it
- Add it to an existing care plan and raise the plan price. Simplest to sell; the report justifies the increase.
- A separate security tier above the basic care plan: monitoring and updates in the base tier, the monthly assessment and report in the higher one.
- A standalone security retainer for sites you do not otherwise maintain, often after a one-off audit. Price for more triage time; you do not know the site's history.
Whichever you choose, write down what "included fixes" means. A common pattern is: configuration fixes and updates included up to a set amount of time per month, anything larger quoted.
An illustrative example
The figures below are an example of the arithmetic, not market rates. Use your own hourly rate and your own timings from the first few months.
| Item | Per site per month |
|---|---|
| Scanner: ScanBastion Agency, $59 for 15 sites | $3.93 |
| Triage: 30 minutes at an internal cost of $60/hour | $30.00 |
| Included fixes: up to 30 minutes, averaged | $30.00 |
| Report review and sending: 15 minutes | $15.00 |
| Cost | $78.93 |
At a target gross margin of 50%, that example prices at roughly $160 per site per month for the security tier, or as an increase on an existing care plan of the same order. Agencies that already patch and monitor will find triage and fixes overlap with work they do anyway, which lowers the real cost.
Two things move the number more than anything else: how much fix time you include, and how long triage takes. The second falls sharply after the first month, once the false positives are dismissed and the decisions carry forward. Price the first month as an onboarding audit, separately.
Selling it
- Start with a free external check of the client's site in the sales conversation. A grade and three concrete issues make the case better than a slide. The free headers and TLS checker is enough for that.
- Show a sample report, not a feature list. The client is buying the document they will receive every month; see the sample report.
- Lead with the before-and-after. The second report, showing what was fixed, is the moment the client sees the value. Make sure it happens in month two.
- Be honest about scope. External scanning has limits; the guide what a website vulnerability scan checks, and what it misses is written to be shared with clients.
A monthly routine that keeps the margin
- Scan every client site in the first week of the month with the same profile.
- Triage new findings only; previous decisions carry forward.
- Fix what is included; quote what is not.
- Rescan the sites with fixes, so the report shows them resolved.
- Send the report with a two-line summary in the email body.
For WordPress clients, the WordPress agency security assessment checklist covers what to check inside and outside the site.