How to Package and Price the Proactive Security Work Your Clients Already Pay For

The QBR deck for a 180-seat client lists a posture assessment, a remediation roadmap, a refreshed policy set, and the gap your team closed ahead of their cyber insurance renewal. Cynomi’s State of the vCISO 2026 report says service providers put an average of 54% of their effort into exactly that kind of proactive work. The invoice the same client pays every month says managed security monitoring, and monitoring and detection is the largest budget line for 38% of clients, against 28% for proactive services.

Your proactive work is being paid for under the monitoring line, so your client’s finance lead files it as monitoring, and at renewal you get no credit for the proactive work. One of those two figures is an average share of provider effort and the other a share of clients naming their largest budget line, so you cannot subtract them into a gap; side by side, they describe that one situation.

Managed security hides this better than most service businesses do. A quiet quarter is the product. The assessment that found the exposed RDP port, the roadmap that sequenced the fixes, the policy work that got the client through their audit: none of it produces a ticket the client can count. The only place any of it gets a name is the invoice, and that invoice was written back when the practice sold monitoring. Nobody has rewritten it since.

Where Proactive Security Work Gets Done

Walk a week in your delivery queue and the proactive work is everywhere except the service catalog. The onboarding assessment that takes a senior tech two days. The roadmap the account lead rebuilds every quarter because the client’s priorities moved. The policy refresh that happens because the client’s insurer added a question. The evidence pull before an audit. The budget conversation in September where your lead tells the client’s CFO what next year should cost and why. Each of those is planning, risk reduction, or compliance work, which is exactly the category the report’s providers put more than half of their effort into.

Clients are asking for the same work. Providers in the report estimate that, on average, 56% of their clients ask for strategic guidance beyond fixing technical issues, and 45% of providers say that between 51% and 75% of their clients ask. The estimate matches what the delivery queue shows: the requests arrive between QBRs, by email, on the back of a ticket, in the “while I have you” at the end of a call. Kaseya’s 2025 benchmark of MSPs found the same thing from the provider side, with 64% saying clients want guidance on best practices on top of the tools. It goes wrong at the next step, when the work is converted into a line on a bill.

How Service Providers Bill Strategic Advisory Today

Asked how strategic security advice is most commonly commercialized, providers in the report split four ways.

Three in ten providers have the proactive work on no line of its own. The client in the 19% group is paying for it inside a bundle with another name on it. The client in the 12% group is getting it for free and has no way to know that.

The split moves with the kind of shop you run. 24% of MSPs sell advisory as a separate paid service against 39% of MSSPs. The MSP column is 59 respondents, so treat the exact figure as directional. The direction fits what you see in the market. Security-first shops learned to put advisory on its own line because advisory was the thing they were selling. Shops that grew out of managed IT added security to an all-inclusive price and kept adding.

The all-inclusive instinct is a good one for support and the wrong one for proactive security. An all-inclusive price gets compared on the monitoring it includes and the seat count it covers, and the roadmap inside it is invisible to the comparison. When a competitor quotes the same seat count for less, your client’s finance lead sees two monitoring prices and one of them is higher. The assessment and the roadmap you delivered do not appear anywhere on that comparison.

How a Client’s Finance Lead Reads the Line Items on the Security Invoice

Your champion is the IT director who sat in the QBR. The person who approves the renewal reads one label and one number, compares both with last year, and compares the number with any other quote that crossed their desk. A line item that says “managed security” with a number that went up reads as a price rise, whatever the deck showed in the meeting.

A line called “advisory” will read no better than “managed security” to that person. Barracuda’s 2025 survey of 2,000 mid-market security buyers found some reluctance to spend extra on softer services such as incident simulation, presenting the case for investment, or guidance on which services they need. Clients in Cynomi’s report, asked what would make them more likely to renew or expand, rank the deliverables high and the packaging low. Risk visibility, strategic advice, compliance support, and executive reporting lead the list, and clearer service packaging and outcome-based pricing sit at the bottom at 14% and 12%. So the line names the deliverable and its outcome: the assessment and the score it produced, the roadmap and the three items closed this quarter, the policy set the auditor accepted.

And the willingness is there once the line has a name. 83% of clients say they would be likely to buy strategic advisory as a standalone service, a figure that includes the 10% who say very likely. In the same survey, 95% say they would be more likely to increase overall security spending if their provider offered more proactive planning and strategic guidance (89% somewhat more likely, 6% much more likely). That is an opening, described by mid-market and enterprise buyers saying what they would be likely to do. It is wider if you are in the room before the number exists, building a planned budget instead of a picked one. The proactive line is then on the client’s own budget sheet before it is on your invoice.

How to Package and Price Proactive Security Services

Three moves, matching the three paid groups in the report, each with a trade-off you should pick on purpose. Whichever you choose, the line names the deliverables the QBR deck already shows: security posture assessment and roadmap, policy and compliance program, security planning and executive reporting. Your account lead is afraid the client reads the new line as a new charge. The deck shows it is the same work with its name on it.

Sell it as a separate paid service

The 38% route, and the one that puts the most MRR on the table per account. The proactive work becomes its own monthly retainer beside the monitoring line, scoped to a fixed cadence: the assessment on onboarding, the roadmap refreshed quarterly, the policy set maintained, the reporting delivered in a form the client can forward. A separate line can be declined. So run it on the accounts that already ask for guidance between QBRs; they will not decline something they are using. On a 10-client book, moving three such accounts onto a separate line at, say, $1,500 a month is $4,500 of MRR that was previously doing its work under the monitoring label. The bands and models for pricing that line are covered in how MSPs price vCISO services, so start from those bands before you settle on a number.

Put it in the premium tier

The 30% route puts the proactive work in the top tier, and the account moves up as a whole. That means one conversation per client instead of two, and a tier name the client compares against your own lower tiers rather than against a competitor’s monitoring quote. The client who wants the roadmap and nothing else in the tier now has a reason to say no to all of it, and the proactive work is back to being one feature in a list. This is the move for a book where most accounts sit at a similar maturity and the tier ladder is already how you sell.

Name it in the standard package

The 19% route, and the one most developing practices should run first on the accounts that will not pay more this year. Nothing changes on the price. The line on the invoice changes from “managed security” to the deliverables it contains, so the monitoring price now carries the assessment, roadmap, and policy work on its face. No new money this cycle; that is the trade-off. At renewal, though, the comparison becomes one monitoring quote against a line that lists the work the client’s auditor and insurer asked about last year. This is also the only move that answers “were you overcharging us before” before the client asks it. The price and the work are the same as last year, and the invoice now says what the work was.

Find the advisory you already give away

The 12% who provide advisory informally at no charge are running the standard-package model without the line, and the gap between the two is a single invoice edit. Pick whichever of the three moves fits the account and make the edit.

The hard part on a 30-client book is seeing which accounts are getting proactive work with no line on their invoice. The question runs across the whole book: which clients had an assessment this year, which ones have an open roadmap, which ones got a policy refresh, and which of those are paying a monitoring-only price. Cynomi’s Revenue Insights is built for that view. It maps the gaps found in each client’s assessment to the services that close them, across every account, so the unsold proactive work shows up as a list your account leads can work through.

Which Clients to Repackage First

Start with the three or four accounts that ask for guidance between QBRs and have a renewal, an audit, or an insurance questionnaire on the calendar in the next two quarters. Those are the clients whose finance lead is about to read the invoice closely anyway, and the ones where a line that names the assessment and the roadmap answers a question they were about to ask. Run the separate-line move on the accounts that are visibly using the work, the standard-package rename on the rest, and leave the tier move for the next time you rebuild the ladder.

Then let the calendar do the selling: every renewal for the next year is a chance to put the proactive line in front of the person who signs, with the deck that proves it beside it. The effort is already at 54%, and the job is to get the invoice to say so.

The full findings, including how providers and clients each describe the proactive work, are in Cynomi’s State of the vCISO 2026 report.