Three in four service providers expect the efficiency AI gives them to show up as higher profit margins over the next two years, according to Cynomi’s State of the vCISO 2026 report. The report also asked clients what should happen to the price when their provider gets significantly more efficient through AI, and 84% said hold it and give us more for it. Both sides are describing the same gain, and they have already assigned it to different people. The AI dividend is a deliverables question before it is a pricing question.
Most providers held their prices when they brought AI into delivery, so nobody has had the argument yet. That is what the clients in the survey asked for, and the invoice did not change. The disagreement is about who owns the gain from here, and it surfaces the first time a client asks what AI changed in the service they pay for. Pricing AI-era security services comes down to having that answer ready before the question arrives: how to hold the price and add deliverables a client registers, and what to say at renewal when they ask where the savings went.
Your efficiency is invisible to the client. They never watch the AI and automation in your delivery build the assessment or draft the policy. They see what arrives, when it arrives, and what it costs, so the only evidence a client will ever have that AI changed anything is the output that reaches them.
What Clients Expect When Their Security Provider Uses AI
Clients have a specific list, and a lower bill is at the bottom of it. Asked what they expect from a provider that uses AI, 60% named better reporting, 59% faster service delivery, 55% better outcomes, and 54% more proactive recommendations. Lower costs came last at 24%. Asked directly what should happen to the price, 54% want the same price with better service quality, and 30% want the same price with more services. Those two answers added together are the 84%. Another 15% said it should come down. One client in 200, 0.5% of the sample, said the provider should keep the gains as profit, according to the survey.
Providers, asked how AI efficiency would benefit their business, put higher margins first at 75%, then greater capacity to serve clients at 73% and faster delivery at 72%. Lower prices for clients sat at 13%, so on that line the two sides agree. The other shared line is scope, where 47% of providers expect to deliver more services at the same price, and clients said the same thing at 30%. The gap is at the top of each list, where providers see margin and clients see reporting they can read and recommendations they did not have to ask for.
The two groups were asked different questions, so read the lists as two views of the same market.
How AI Has Changed Provider Pricing So Far
AI has changed almost nothing about provider pricing, and that is the accidental alignment. Across the sample, 89% of providers have not changed prices because of AI. Most of them, 54%, kept prices unchanged despite using it, and the other 35% say AI has not influenced their pricing decisions at all. Only 10% of providers have raised prices, and none reported cutting them. Adoption is nearly total: 65% use AI across multiple services, and just 1% do not use it anywhere. A separate 10% say AI is already embedded in most of their workflows.
The 35% reads as a pricing conversation providers have not had with themselves, let alone with a client. The rest held the price on purpose, which is what clients asked for. The report’s own framing is that AI is shifting the expectation of value rather than the price: clients expect more for the same price, and at some point they check whether they got it.
The 10% who raised prices have outside evidence on their side, and so do the holders. IDC reports that 55% of IT buyers expect AI-powered managed services to cost more than traditional providers, while 37% expect prices to fall. In Barracuda’s 2025 survey of 2,000 MSP customers, run by Vanson Bourne, 38% said a price increase, or a better offer from another MSP, would lead them to switch provider for cybersecurity support. A mature practice with a security stack its clients cannot replicate can take the raise. If yours is the developing practice, the hold is the position clients already endorsed, and the work is making it visible.
Legal services ran the same experiment first and show where the sequence leads. Deloitte’s October 2026 point of view on legal pricing lays out the order. Law firms keep the AI gain in the short term, clients ask for it back as lower fees in the medium term, and the lower fee becomes the benchmark after that. Mid-market security buyers are still asking for the reporting.
How big the gain is depends on which survey you resemble. Among vCISO providers already using AI, the 2025 edition of the report found a 68% average drop in workload. Kaseya’s 2026 State of the MSP report found more than half of MSPs have automated only about a quarter of their workload. In the same survey, 48% named AI and automation as their clients’ top need and only 13% earn meaningful revenue from it, so for most practices the gain is still a cost saving with no line item of its own. Your number sits somewhere between the two, and those are the hours you have to spend on deliverables.
How to Hold the Price and Add Deliverables Clients Will Register
Add one deliverable from the client’s own list to the tier they are already on, and leave the price where it is. The list is short. Clients expect better reporting and more proactive recommendations from an AI-using provider, and both come out of hours rather than headcount. That could be a posture update that goes out monthly instead of quarterly, or a mid-year re-run of the annual assessment. It could be a ranked next-90-days section on the remediation roadmap, or a recommendations note after every control change rather than at the review. Pick the one that your platform already produces most of, so the hour you spend on it is review rather than assembly.
The tier structure is what makes this a scope move rather than a giveaway. A full vCISO program for a client of 50 to 500 employees runs in the $2,000 to $3,500 a month range in tiered packaging for advisory services, with a strategic tier above it. When a client at the middle tier reaches renewal, move one deliverable down from the tier above instead of moving the price down. The client gets the thing they said AI should buy them. The tier above still has everything else in it, so it keeps its reason to exist. And the deliverable you moved is one you can name, date, and point to a year later.
A deliverable registers when the client can forward it: a dated note with their name on it and one decision in it counts. A login they were given does not, and neither does a line in your service description. The test is whether the client’s IT director could send it to their CEO without adding an explanation. The reporting clients expect from AI is reporting that travels inside their own building without you.
Write it down where the renewal happens: put a “changed since last renewal” line on the renewal document, with the deliverable, the date it started, and the date it will be reviewed. The point of the line is that it answers the AI question before the client asks it, in writing, in a document they will have open when they decide. If you held the price and added a deliverable, you have done what 84% of clients asked for; the line is how the client finds out.
Start with the accounts that have a renewal inside two quarters. That is where the question will come first, and where the deliverable has time to land before it does. Keep the price where it is, and treat everything else as yours to pick per account: which deliverable, and which accounts get it first. A book of 10 clients does not need all 10 on the same one. If your efficiency gain is on the small side, run this on one deliverable for the accounts with a date, and let the rest wait until the hours exist.
What to Say at Renewal When Clients Ask Where the AI Savings Went
The question is coming from the 60% who expect better reporting. When it comes, it is a good sign: a client asking what AI changed is a client paying attention to the service. Before you answer, ask what they wanted the savings for, because the answer names the deliverable you should have added already. Then the answer is four sentences, said in order, in your own numbers.
“Yes, we run AI across delivery, the same as nearly every provider in the market.” A client who hears a hedge here hears a provider who thinks AI is something to admit to.
“Here is what it changed.” Pick two numbers from your own delivery, in units the client has felt: hours per assessment, turnaround on a policy set, or time from a control change to a recommendation.
“Here is where those hours went.” The deliverables you added since the last renewal, by name, with dates. If the “changed since last renewal” line is on the document, read it to them.
“The price held, which is what most clients say they want.” Then stop talking. The client has the data, the deliverable, and the price, and nothing on that list is a surprise.
If they push for a discount anyway, trade scope: offer the next deliverable from the tier above, or a mid-year assessment, or the recommendations note on a faster cadence. A percentage off is permanent and becomes the benchmark the next renewal starts from, which is the sequence Deloitte describes in legal services. A deliverable is reviewable.
The answer to retire is “AI hasn’t affected our pricing.” It is true as far as it goes. Your client can see that the price held, and may have read that providers expect higher margins from AI. To that client, the answer reads as either you do not know what AI did to your costs or you would rather not say. The four sentences above answer both doubts in your own numbers.
Pricing AI-Era Security Services Without a Renegotiation
The deliverables have to come out of your platform rather than out of a senior’s weekend. Otherwise the hours you add back are the hours AI took out, and the margin you expected disappears into assembly. With Cynomi, your team generates the assessments, roadmaps, policies, and executive reporting from the work it already did on the account. That is what allows you to scale vCISO services without adding headcount as the book grows, and put the dividend where your clients said they wanted it.
The clients have already voted, and the vote was one in 200 for the provider keeping the gain. Pick the accounts with a renewal inside two quarters, add one deliverable from their own list, date it, and write it on the renewal document. When the question comes, the answer is already in their inbox.
Table of contents
