Retainers that show their balance. Every morning.
Every retainer client’s hours left, every morning. A vCISO tier of 8, 16 or 24 hours a month is a budget, and the hour past it waits.
Industries · Security MSSPs
An incident burns hours. The retainer keeps count.
Subscriptions stay where they are. Retainers, vCISO tiers and assessments are sold in hours. Ceed holds the hour that would cross them.
For MSSPs of two to fifty people. Ceed runs the hours you sell, not the endpoints you monitor.
Larkspur Bancorp · August · response retainerHeld
32.5 of 30 h
Thu 27 Aug · 4.0 h · Business email compromise, mailbox-rule triage · Priya N.
Held for approval. 2.5 h over the retainer.
ApproveDecline
$9,000
the response retainer
30 h
the hours behind it
$450
the surge hour past it
$9
Ceed, this month
Surge rates on the invoice. Or a decision at the hour.
A response retainer is thirty prepaid hours a year until a mailbox rule appears on a Thursday. The block is drawn down after the engagement, when the lead’s hours are compiled into an invoice at the surge rate, and the client reads the overage there.
Ceed counts every response hour against the retainer as it is logged. The hour that would cross the block waits for the account owner. The client hears about surge hours during the incident, from you, and the invoice matches what was said.
“If you scope it as a project, you either underscope and eat hours, or overscope and the client feels like they’re paying for shelf-ware.”
Brian Haugli, chief executive of SideChannel, on r/msp, April 2026.
Held. Not hidden.
The hour that would push a client over budget is saved, marked, and waits for a yes or no. Nothing is billed quietly. Nothing disappears.
- Logged
4.0 h · Larkspur Bancorp · BEC triage
- Held
Over the 30-hour retainer. Waiting for Omar.
- Approved
1.5 h inside the retainer. 2.5 h at $450, with the client’s yes on the record.
One set of hours. Everything follows.
Contract responders. Same record.
A 1099 incident lead or vCISO is paid from the entries your invoice used. One log, two documents.
Beside the SOC console. Not instead of it.
Your SIEM, SOAR and ticketing stay where they are. Ceed is the record of hours and money for the work you sell by the hour.
Invoice · Larkspur Bancorp · August 2026Computed
Incident response retainer · 30 h at $300.00$9,000.00
Approved surge hours · 2.5 h at $450.00$1,125.00
Total$10,125.00
Computed from the retainer agreement dated 12 Jan 2026. Nothing typed.
From the field. In their words.
What MSSP and vCISO operators say in public about retainer hours, incident surge and pricing. Linked and dated. Not our words.
Said on X.
Your IR retainer has never once looked at your environment. It exists so a lawyer can say “we have a plan” if asked. Paperwork and readiness are not the same thing.
The retainer may include a limited number of vCISO consulting hours per month, but the rate for an executive level vCISO consultant is high enough that the model can break without that limit. Either the retainer price gets too high for the small SMBs, or the MSP ends up eating the extra consulting hours and erodes their margins.
The Group-IB Services Retainer spans the full incident lifecycle: from maturity assessments, red teaming, and tabletop exercises to containment, eradication, and recovery. Prepaid hours flex across the entire cycle, ensuring organizations get continuous value, not just emergency coverage.
Said on YouTube.
Said elsewhere.
- YouTubeHow to Price Your Cyber Security ServicesPhin Security · 2024 · 17 min · pricing security services to small clients
- RedditThose offering vCISO or similar cyber-adjacent consulting services, how do you charge?r/msp · April 2026 · tiers that map to hours a month, and compliance sprints on time and materials
- RedditWhat do you all charge for vCISO servicesr/msp · February 2024 · $175 to $395 an hour, and why hourly never worked out
- RedditHow many cases do you handle per shift in an MSSP SOC?r/cybersecurity · August 2026 · what two analysts inherit at the start of a shift
- RedditCurrently looking at incident response retainers, what am I missing?r/cybersecurity · February 2024 · a buyer asks whether unused hours convert to training
- ArticleThe incident response retainer buyer’s guideDecryption Digest · May 2026 · surge billing, rollover and the coverage gaps found mid-incident
Of what you invoice. That is the pricing page.
Invoice $9,000 for the retainer this month and Ceed costs $9. The monitoring subscription you invoice from your own system is not Ceed’s invoice and costs nothing. No seats, no tiers, no minimum.
Questions. Answers.
Does Ceed replace our PSA, SIEM or ticketing?
No. The console stays the console. Ceed is the record of hours and money for the retainers, tiers and assessments you sell in hours. Hours are logged in Ceed, from Slack, in a minute a day.
Incident hours are logged at 2 a.m. Does the hold stop the responder?
No. The hold holds the billing question, never the work. The hours are logged and held, and a named person decides in the morning.
Our retainer lets unused hours convert to a tabletop. Can Ceed carry that?
Ceed keeps the block and the two rates, and computes the invoice from them. What you do with unused hours is written in your agreement, and the decision is yours, on the record. Write to hello@ceed.so with your clause and a person replies with how it maps.
Detection and response seats are most of our revenue and none of it is hourly. Is 0.1% charged on that?
No. Ceed charges 0.1% of the invoices it computes. Subscriptions you invoice elsewhere are not Ceed’s invoices.
Our vCISOs are 1099. Does their statement come from the same held hours?
Yes. The payout statement is computed from the entries the invoice used, held hours included once they are approved.
From the blog: Held. Not hidden. The agreement said 40 hours. The month said 47. Other firms Ceed is for: Security consultancies · IT MSPs · IT consulting · all nineteen.