Rates and margin. Enforced on the server.
Who may see rates and margin is granted by the owner and enforced on the server. Client names never leave your tenant.
Industries · Security consultancies and vCISOs
Built by a security firm. For security firms.
YSecurity built Ceed to run its own books: capped retainers, engineers across clients, contractors paid from the same hours. We run on it today.
The record YSecurity runs on. Not a demo tenant.
Kestrel Medical Devices · MarchHeld
22.0 of 20 h
Mon 9 Mar · 2.0 h · Phishing incident triage · Alex D.
Held for approval. 2.0 h over the client’s budget.
ApproveDecline
$6,000
the monthly fee
20 h
the hours behind it
$300
the hour past it
$6
Ceed, this month
An incident burns hours. The record keeps them.
A vCISO retainer is twenty hours a month until a phishing email lands and the month is gone by the ninth. Every hour of the response is on the record. The one that crosses the cap waits for a decision, and the client hears about the extra before the invoice, not on it.
Held. Not hidden.
The hour that would push a client over budget is saved, marked, and waits for a yes or no. Nothing is billed quietly. Nothing disappears.
- Logged
2.0 h · Kestrel Medical · Incident triage
- Held
Over the 20 h budget. Waiting for Dana.
- Approved
On the March invoice, at $300 an hour.
One set of hours. Everything follows.
Contract testers. Same hours.
The tester’s payout statement is computed from the entries the invoice used. One log, two documents.
Beside your ticketing. Not instead of it.
Tickets, chat and your compliance tooling stay where they are. Ceed is the record of hours and money they work from.
Invoice · Kestrel Medical Devices · March 2026Computed
vCISO retainer · 20 h$6,000.00
Approved hours past the budget · 2.0 h at $300.00$600.00
Total$6,600.00
Computed from the agreement dated 15 Sep 2025. Nothing typed.
From the field. In their words.
What security consultants and vCISOs say in public about capped retainers, incident hours and pricing. Linked and dated. Not our words.
Said on X.
Arguably pentest pricing should be decided after the engagement. … I’ve tested small apps / networks with a ridiculous number of vulns. I’ve tested huge apps / networks that were amazingly secure.
No doubt pentest pricing is all over the place and of course it varies depending on the engagement. From premium to super cheap.
But the price of a pentest, in my opinion, should not be solely dependent upon static numbers like IPs. Just because theres only a handful of IPs doesn’t mean the effort is small.
RiskAware’s fractional vCISO service operates on a virtual retainer model that allocates a bucket of hours you can apply to capabilities as you see fit.
Said on YouTube.
Said elsewhere.
- YouTubePenetration Testing Process Explained Step by Step, Consulting Company Point of ViewInfoSec Pat · scoping, testing and reporting from the firm’s side
- RedditThose offering vCISO or similar cyber-adjacent consulting services, how do you charge?r/msp · April 2026 · tiers that map to hours a month
- RedditWhat do you all charge for vCISO servicesr/msp · February 2024 · $175 to $395 an hour, and why hourly never worked out
- RedditI’m a former CISO who left to start my own security companyr/cybersecurity · 2025 · 389 votes · a practice built from scratch, rates and all
- XAdding vCISO to a managed security practice@vCISOServices · March 2024
- ArticlevCISO pricing models compared: hourly, retainer and outcome-basedCycore Secure · July 2025 · the ten-hour assessment that takes thirty
- ArticleHow much does a virtual CISO cost in 2026Compass IT Compliance · January 2026 · ask for a retainer with a not-to-exceed cap
Of what you invoice. That is the pricing page.
Invoice $6,000 this month for Kestrel Medical Devices and Ceed costs $6. A month you invoice nothing costs nothing. No seats, no tiers, no minimum.
Questions. Answers.
An incident blows through the month’s twenty hours at 2 a.m. Does the hold stop my engineer?
No. The hold holds the billing question, never the work. The hours are logged and held, and a named person decides in the morning.
Where is our data, and who holds the keys?
In your tenant, on Google Cloud. Client names never leave it. Rates and margin are visible only to the people you grant, and the server enforces it. Write to hello@ceed.so for the security posture in full and a person replies.
We run a ticketing system for delivery. Does Ceed replace it?
No. Tickets stay where they are. Ceed is the record of hours and money: the cap, the hold, the invoice, the payout, the close.
Our testers are contractors paid by the hour on fixed-fee jobs. Same log?
Yes. Payout statements come from the same entries as the invoice.
Can the client see that an hour is held?
No. The hold is yours. The client sees what the agreement puts on the invoice.
From the blog: Held. Not hidden. The agreement said 40 hours. The month said 47. Other firms Ceed is for: Security MSSPs · IT MSPs · IT consulting · all nineteen.