What a cybersecurity consultant costs
What drives the price of a cybersecurity consultant for a mid-market company, how fixed-fee work compares with hourly billing, and what to check first.
A cybersecurity consultant for a mid-market company is usually priced in one of three ways: a fixed-fee assessment, an hourly or daily rate, or a monthly retainer. For a company with 50 to 500 employees, the sensible first purchase is a paid assessment with a fixed scope, because it tells you what the work actually is before you commit to a program.
That answer is short on purpose. The rest of this article explains what moves the number, what to ask before you sign, and where the cheap option turns expensive.
The three ways consultants price security work
Fixed-fee assessment. You buy a defined scope and a defined deliverable: interviews, a control review, a gap list, a roadmap. The consultant carries the risk of scope creep. This is the easiest engagement to compare across firms because the deliverable is named in the proposal.
Hourly or daily rate. You buy time. It works when the scope is genuinely unknown or when you need a second opinion on one decision. It is a poor fit for open-ended program work, because the invoice grows while the deadline stays fixed and nobody owns the outcome.
Monthly retainer. You buy part-time leadership. The consultant holds a standing calendar slot, attends the meetings a security leader would attend, and owns the program between meetings. This is the right shape for ongoing work such as audit preparation, vendor reviews, and board reporting.
What actually changes the price
Five things move a security engagement more than the consultant's brand.
- The number of sites and systems in scope. One office with cloud-only systems is a different job from five sites, a warehouse floor, operational technology, and a mix of legacy servers.
- The deadline. An audit window or an insurance renewal date compresses the work and usually requires senior attention earlier.
- The evidence you already have. If policies, logs, and access lists live in one place, the assessment is faster. If they are scattered across email and three departments, the first job is collecting them.
- Whether you want a document or a program. A report is cheap. A roadmap your team can execute, with owners and dates, takes more time.
- Who does the work. A firm that sends a partner to sell and juniors to deliver is priced differently from one where the practitioner who scopes the work also writes the findings.
Our published numbers
We do not quote a range and negotiate from there. The entry point is a paid Security & AI Risk Diagnostic: 15 business days, $9,500 for one site, $12,500 for two, $14,500 for three or more, with two on-site or two full remote workshop days. The readout includes a NIST CSF gap list, a risk-ranked roadmap, an AI use-case inventory, and a first 90 days plan. You can read how the security assessment works.
Ongoing leadership is priced monthly: $9,500 a month for the Fractional CISO retainer, two days a week on a 90-day initial term. That is the whole price list. Anything else is scoped in writing after the diagnostic, against the evidence the diagnostic produced.
Questions to ask before you sign
- What exactly will I receive, and in what format?
- Who does the work, by name, and how many days are they on site?
- Is the fee fixed, and what would make it change?
- How will you show that a control passed or failed, and what evidence do you leave behind?
- Who owns the report and the roadmap when the engagement ends?
- Do you sell the tools you recommend? A consultant who resells software has a conflict you should price in.
Where cheap becomes expensive
A free audit is a sales call with a report attached. It gets rescheduled because nothing is at stake, and it is usually scoped to make the follow-on project look necessary. A price quoted per finding rewards a long list rather than a fixable plan. A promise of a clean audit, offered before anyone has read your evidence, is not a promise; it is a sales line.
The useful comparison is not the lowest fee. It is the cost of the first quarter of work plus the cost of redoing it with someone else.
If you want the arithmetic for your own company, start with a 30-minute call. Request a briefing and we will tell you whether the paid diagnostic makes sense before you spend anything.