Blog · 7 July 2026 · Jon McLachlan

The invoice told us last. Why we built Ceed.

We ran a security consultancy on a spreadsheet. One month it ran tens of thousands of dollars past the hours a client had bought, and we found out when we wrote the invoice. This is what over-servicing and unbilled hours look like from inside a firm that sells its team’s time, and what we built to stop it. Updated in September 2026 with five recordings, five threads, two posts from X, the research on timesheets, and seven books.

YSecurity sells its team’s time. Penetration tests, compliance programs, identity rollouts, incident response, billed in fifteen-minute increments against a monthly cap, with no retainers and no minimums. It is a good business with one hard question at the end of every month. Did the hours we worked become the money we earned.

The industry has names for the gap. One time-tracking vendor defines time leakage as “any billable work that goes unrecorded, miscategorized, or never appears on an invoice.” Agencies call it over-servicing. Accountants call it scope creep. Inside the firm it is simpler than any of those. It is an hour somebody worked that nobody decided to give away.

For years our answer lived in a spreadsheet. Each client had a tab. Each tab had the cap the client had bought, the rate, and the hours the team typed in from memory on Friday afternoon, or the following Tuesday. The rules we had agreed with our clients lived in cells. The cells held if somebody remembered to check them.

The hours were the weakest cell. A timesheet filled in from memory is a guess, and the research on how bad a guess has been available for a decade. Accelo, which makes software for firms like ours, surveyed more than 500 professionals in the summer of 2014 and found that people who record their time daily are 66% accurate, people who record it weekly are 47% accurate, and people who record it less often than weekly are 35% accurate. Logging daily cut the time lost to memory from 23% to under 5%, and the company put the cost of the weekly habit at about $52,000 per professional, per year. Our team logged on Fridays.

The people filling in the sheets know it. When a system administrator asked r/sysadmin in June 2023 whether it was normal to account for every hour of a salaried day, a requirement explained to him as being “to show how profitable we are as a company,” the thread reached 503 points and 647 comments. The top reply, at 578 points: “the last task, every day on my timesheet was ‘Filled out timesheet of completed daily tasks’.” Another, at 149, logged one line of eight hours a day that read “Did the needful.” The most upvoted post on the subject in r/consulting, at 342 points, is a picture of a manager saying “Hey team it’s Friday. Don’t forget to submit those timesheets.” Friday is the problem. By Friday, Tuesday is gone.

The month the cells did not hold.

One month, nobody did. A client had bought a fixed number of hours. The work was urgent and good and the team did it. Nobody logged the extra as it happened, or everybody did and nobody looked, which comes to the same thing. When the invoice was written, the month was tens of thousands of dollars past what the client had agreed to pay.

We were not unusual. In Magnetic’s benchmark of 104 agencies, with a median size of twenty people, 68% said they regularly go over project budgets and 57% said they get no warning before it happens. The month we are describing is the normal month, with a bigger number on it.

The newer numbers say the same thing at industry scale. In February 2026 IDC surveyed 100 professional services organizations in the United States, Canada and the United Kingdom for a white paper sponsored by Kantata, which sells software to those firms, and concluded that firms which look at that kind of software and never adopt it may be quietly losing 5 to 10% of their potential revenue and productivity each year. The paper names the leaks: “5% margin leakage from unmanaged scope due to poor variation tracking,” “up to 20% of skilled employees’ time lost to administration work,” and a “3% delay in invoices being issued.” The sponsor has a product to sell, and the numbers are still the ones every firm we know recognizes. Ours was the 5%, found on the 31st.

Sometimes the invoice never tells at all. In May 2022 a marketer who runs campaigns for small businesses posted in r/smallbusiness that he had been looking through his payments account and realized he had not invoiced a client since the previous October. Six months of work. The client had noticed nothing and neither had he. The thread is small, 33 points, and it is the purest version of the problem: the only place the hours and the money met was one person’s memory, and the person was busy.

There are two things a firm can do at that point, and over the years we did both. You can send the invoice and surprise a client who trusted you, then take the call that follows, and the discount that follows the call. Or you can eat the hours, which means paying your people for work nobody will ever pay you for. Neither is a decision. Both are what happens when the decision was never made.

Missed. Not lost.

We started calling these missed opportunities, because that is what they were. Nobody took the money. We never had the moment in which to keep it.

The hour worked at eleven at night and never counted was a missed opportunity to bill it. The budget crossed on the ninth and found on the thirty-first was a missed opportunity to ask the client, while it was still a question, whether they wanted the extra work. The cap that was too small for a year was a missed opportunity to reprice it, because we could never put the hours in front of the client. The partner paid from a sheet we hoped was right was a missed opportunity to pay them from the same numbers the invoice used. The equity we took from a startup as fees, recorded in no book, was a missed opportunity to know what the firm had earned. And the three days of the owner’s month that went into closing the books were a missed opportunity to do anything else with them.

Every one of them was a decision we did not know we were making. That was the pain. Not the money, though the money hurt. The firm’s own rules were held by nobody at the one moment they mattered, and reported to us afterwards as history.

David C. Baker has measured the same gap across thousands of firms. On 2Bobs, the podcast he hosts with Blair Enns, he put it in two numbers: “the average firm in the marketing, digital, advertising space is capturing 42 percent of all the time rather than 60.” Not because the firms are idle. “It’s not because they’re not busy. They’re busy,” he said, and “the difference between capturing 60 and 42 percent is that they are underpricing some things and over-servicing things.” The hours were worked. They were never counted.

Ron Baker, the accountant who has spent thirty years telling professional firms to throw their timesheets away, said the thing we kept coming back to on his own show in 2016: “By definition, once you see something on a timesheet, it can no longer be managed.” We disagree with him about the timesheet and agree with him completely about the sentence. A record read after the month is history. Ours was a very accurate history of decisions nobody made. In 2010 the ABA Journal filmed him making the longer argument to lawyers, seven minutes on why the hour is the wrong thing to sell.

Jonathan Stark, who has built a practice on telling consultants to stop billing by the hour, is more careful about the record than his reputation suggests. In a thread from February 2023 he said why he keeps the door open.

Our costs were out of control for one month and we did not know it until the 31st. That is the whole case for the record. Not a timesheet read on Friday about Tuesday, but a count made at the hour, by the person who worked it, against the number the client bought, in front of someone with the authority to act before the month is over.

The advice was to stop counting hours.

The advice we heard, and the advice most firms like ours hear, is to stop selling time. Price the outcome, put a fee on the agreement, and let the hours go. Jonathan Stark has built a career on it. On The Futur’s livestream, watched 276,000 times, he described the firm he ran before he changed his mind: “I was fighting with clients about estimates that we went over. I was arguing about invoices and time sheets, and I was always whipping the developers to get their hours in by the end of the week so we could invoice on Monday.” We recognized every word.

Patrick McKenzie, who writes as patio11 and has told a generation of consultants to charge more, put the case for the price in a post from 2019 that consultants still send each other.

David C. Baker made the same point to The Futur in 2020, nine minutes on getting paid for judgment rather than for hours. We agree with all of it, and it was not the problem we had. Whatever we charged, the hours were still our cost, and the cost was counted last.

The consultants who take the advice find the same thing. In August 2023 the owner of a technology consultancy told r/consulting he was moving clients and contractors from hours to tiers, “monthly subscriptions that reflect the average value we both agree we provide,” because “hours do not reflect value.” The thread reached 199 points. The top reply, at 135, was one sentence: “This will only work if you do not underestimate the amount of work involved in the services you provide.” The fee is flat and the hours behind it still have to be counted, by somebody, against something.

We agree with him about the price and disagree about the record. Whether a firm bills by the hour or by the outcome, the hours are its cost, and a cost nobody counts is a decision nobody made. The firms that took the advice sized their fixed fees in hours anyway, then stopped watching the number. That is the subject of They see the fee. You see the hours. This post is about the moment the number is crossed. What the same missing record does to getting paid, to the rate and to the agreement is in three later posts: The client paid late. The invoice was later., The rate was set on day one. The client grew. and The agreement said 40 hours. The month said 47.

Alert. Refuse. Hold.

So we asked what software would have to do to have stopped that month. Not what it would have to show us. What it would have to do.

When an hour crosses a client’s budget, a system can do one of three things. It can tell you later, in an email the next morning, which is a report, and by then the hour is in the month. It can refuse the hour, which means the work was done and the record now says it was not, and the hour is eaten before anyone decides. Or it can hold the hour: save it, mark it, and put it in front of a named person for a yes or a no, the moment it is logged.

The refusal is the industry default, and the people inside it describe it precisely. In July 2025 an accountant posted in r/Accounting under the title “Manager: ‘Never eat hours.’ Also manager: ‘Why did you go over budget?’” They had logged fourteen honest hours against an eight-hour budget and were marked down for inefficiency. The thread reached 920 points. The top reply, at 218: “Welcome to public accounting where the budgets are made up and the hours don’t matter.” Another, at 31: “They want you to eat your hours, they don’t want to know you are eating your hours.” That is a refusal with a human face. The hour is worked, the record says it was not, and the person who did the work carries the difference.

We built the third. If an hour would push a client over budget, Ceed holds it for approval the moment it is logged. The hour stays on the record. The budget still holds. The person who logged it knows at once, the account leader decides that day, and the client hears about the extra before the invoice, not on it. Held. Not hidden. became the rule everything else follows, and that post shows what the person who logged the hour sees.

The invoice comes from the agreement.

The second rule came from the invoice itself. Ours had been typed, from a spreadsheet, by a person who was tired. In Ceed the invoice is computed from the agreement: the retainer, the budget, the rates by role, the discounts, the equity taken as payment. It comes out the same way every time, and it matches what the client signed because it was made from what the client signed.

The same entries pay everyone. The contractor’s payout statement and the partner’s commission come from the hours the invoice used, so there is no second sheet to reconcile and no argument on payday. Margin per client is visible this morning, to the owners and whoever they name, and the server enforces who sees what. When a month closes, it closes. The invoices, the statements and the margin are frozen as a record, and nothing in it changes after. The close stopped being a project and became a record.

0.1%. That is the pricing page.

We priced Ceed the way we wished our own tools had been priced. 0.1% of what a firm invoices. No seats, so adding a contractor for a month costs nothing. No tiers, so the hold is not a feature on a higher plan. No minimum, so a month you invoice nothing costs nothing. Invoice $200,000 and pay $200. The rate never moves, so the renewal email never arrives.

Our books first.

Ceed is the record YSecurity runs on today. Every hour our team logs, every client’s cap, every invoice, every payout statement and every close goes through it, and the rule that would have saved us that month holds itself now, at the hour, without anyone remembering to check.

Jon McLachlanCo-founder. Started in security at Apple. Led teams at Pure Storage, UnifyID and Robinhood.

Sasha SinkevichCo-founder. Built security from the ground up at Robinhood, Yugabyte and Symphony.

The firm behind Ceed also hosts The Security Podcast of Silicon Valley, 98 conversations since 2021 with the people who build and run security. Three of them are with people who run the kind of firm this post is about.

• 7
  Michael Brooks, vCISO and Director of Cyber Risk Services at TravaAugust 2021 · The fractional CISO model, from someone who runs it. The kind of practice Ceed starts with.
• 14
  Biff Clark, owner of Coefficient TechnologiesMarch 2022 · Fifteen years of running a small security consultancy, the business side included.
• 80
  Ted Harrington, author of Hackable and a partner at Independent Security EvaluatorsOctober 2025 · On the mindset that improves systems rather than exploiting them.

Two other shows have said in public what we learned in private. The Soul of Enterprise, Ron Baker and Ed Kless, spent an episode in September 2016 on trashing the timesheet, which is where the sentence about management above comes from. The Agency Profit Podcast, from Parakeeto, walked through a real agency in November 2025 whose revenue was almost entirely going to pay its own people, and whose first fixes were getting the team to log time and counting account management as delivery. And the advice at Y Combinator’s Startup School is the one we followed without knowing it: notice the problem you have yourself, and check that other people have it too.

What the books say.

Seven books for the owner of a firm that sells its team’s time, in the order we wish we had read them.

• The E-Myth RevisitedMichael E. Gerber, 1995. Why the technician who starts a firm ends up running it from a spreadsheet, and what a system is for. The first book most consultancy founders are handed, for a reason.
• The Mom TestRob Fitzpatrick, 2013. How to find out whether other people have your problem without leading them. The questions to ask before you build anything.
• ReworkJason Fried and David Heinemeier Hansson, 2010. Scratch your own itch, and the short chapter on why estimates are guesses.
• Managing the Professional Service FirmDavid H. Maister, 1993. The book on how a firm that sells time actually makes money, including the arithmetic every owner should know on how hours worked become hours billed.
• Implementing Value PricingRonald J. Baker, 2010. The case against the hour from the man who has made it longest. Read it to understand what the price should be, then keep the record anyway.
• Built to SellJohn Warrillow, 2011. Why a firm that lives in the owner’s head is worth nothing to anyone else, and what a buyer wants to see in the record.
• Company of OnePaul Jarvis, 2019. Staying small on purpose, which only works if the small firm’s hours are counted.

Ceed is for firms that sell their team’s time: fractional CFO, CISO, CMO and CTO practices, security and engineering boutiques, consultancies and agencies up to fifty people. If your firm sells its team’s time and finds out about the budget when it writes the invoice, sign up and see the product with your own numbers. Nothing to pay until your first invoice.

Sign upOr write to hello@ceed.so.

Questions.

Jon McLachlan is a co-founder of Ceed and of YSecurity, where the month in this post happened. Published 7 July 2026, updated 11 September 2026. Corrections to hello@ceed.so, and they are dated when made.