Pentest retainer management
one master record, every drawdown tracked
Run pentest retainer agreements as structured records rather than calendar reminders and a separate spreadsheet of hours. Track the contracted block of hours or test count, draw down each engagement against the master agreement, invoice on the agreed cadence, and keep findings, reports, and the remediation history visible across the full retainer term.
No credit card required. Free plan available forever.
Run retainer agreements as records, not calendar reminders
Pentest firms, MSSPs, and security consultants increasingly sell retainer agreements rather than purely project-shaped engagements. The retainer is a commercial commitment from the client and a capacity commitment from the firm, and it lives or dies on whether both sides can see the same balance, the same delivery history, and the same outstanding findings on the same record. When the retainer is tracked in a finance spreadsheet that the delivery team never opens, renewals are negotiated on guesswork and clients quietly attrit because the firm cannot show the work.
SecPortal models a retainer as a parent record on the client with a ledger of contracted hours, test count, or asset coverage. Each engagement run under the retainer opens as a child record that draws down the block at scoping and reconciles the actual at close. Invoices reference the parent and the consumed children. Renewal evidence is the record itself rather than a deck written from memory. The result is that delivery, finance, and renewal share one source of truth instead of three.
Retainer structures teams sell
Four shapes cover most of the retainers pentest firms and security consultants sell. Each has different drawdown semantics, different overrun behaviour, and a different renewal argument; the retainer record captures which shape applies so child engagements inherit the right ledger logic.
Hours-block retainer
A fixed block of consultant hours per term (commonly 40, 80, or 160 hours per quarter). The client purchases capacity rather than scope; engagements draw the block down hour by hour with explicit underrun and overrun rules. Best for clients with unpredictable testing needs and a steady appetite for advisory work.
Test-count retainer
A contracted number of pentests over the term (for example, four web app tests and two infrastructure tests per year). Each engagement consumes one slot regardless of the actual hours. Easiest to invoice, cleanest for compliance audits, and the right shape when scope is predictable and the client wants budget certainty.
Asset-tier retainer
A defined coverage tier across the client estate (for example, all production web applications and all external infrastructure assessed once per quarter, with up to three retests per finding). The retainer guarantees coverage rather than a count of engagements. Common for clients with a fast-changing asset list and an internal compliance or assurance commitment.
Hybrid retainer with advisory hours
A baseline of scheduled tests plus an optional advisory hours pool for ad-hoc reviews, threat modelling, scope discussions, and proposal feedback. The hybrid shape protects delivery cadence while giving the client a structured way to consume consulting time outside formal engagements. Track the test slots and the hours pool as two ledgers under the same parent retainer.
What the retainer ledger captures
A retainer record is more than a contracted hours figure; it is the operating contract for every engagement that draws against it. Six fields define the ledger and govern the downstream behaviour of the child engagements.
| Field | What it controls |
|---|---|
| Contracted block | The starting balance for the term. Hours, test count, or coverage tier, captured once at signing along with the unit (hours, slots, or assets) and the term length so the ledger has a definitive starting point. |
| Drawdown per engagement | The amount each child engagement consumes against the block. Planned at scoping, actual at close. The variance between the two is the early-warning signal that the next engagement needs to be re-scoped before it starts rather than after it overruns. |
| Rollover policy | What happens to unused balance at term end: rollover allowed, capped rollover (for example up to 25 percent), or use-it-or-lose-it. Captured on the retainer record so the renewal conversation does not start with an argument over hours from two months ago. |
| Overrun policy | What happens when an engagement exceeds its planned drawdown: pre-approved threshold, change-order required, or hard stop. Captured per retainer so the on-call PM knows whether to keep going or pause for client sign-off without escalating to the partner who signed the agreement. |
| Priority SLA tier | The response and scheduling SLA the retainer entitles the client to: standard, expedited, or named-team. The SLA shapes which retainers go to the front of the scheduling queue when capacity is tight, and the SLA breach risk lives on the retainer record so it is visible before it becomes a renewal blocker. |
| Billing cadence | Monthly retainer fee, quarterly true-up, or per-engagement drawdown invoicing. The cadence is captured once and drives the integrated Stripe Connect invoicing rather than living in a separate finance spreadsheet that no consultant ever opens. |
Where retainers usually go wrong
Five failure modes account for most retainer attrition. Each one is silent during delivery and loud at renewal, when the client and the firm look at different numbers and the relationship pays the cost.
Hours tracked in a separate spreadsheet
The retainer balance lives in a finance tracker that the delivery team never looks at. Engagements proceed without knowing the running balance, the client gets a surprise overrun email two days after term end, and the renewal conversation opens with an apology rather than a delivery summary.
No link between engagements and the parent retainer
Each pentest is opened as a standalone engagement with no reference to the master agreement. Three months in, the team has to reconstruct which tests were against the retainer and which were paid one-off projects from billing data and Slack history. The audit trail is the inbox.
Rollover and overrun handled in conversation
The contract says nothing explicit about unused hours or overruns and the team handles each case ad-hoc. Identical situations get different answers depending on which partner picks up the call, and the inconsistency surfaces at renewal as trust erosion that nobody can point at a specific cause for.
Findings and remediation reset every engagement
The retainer runs for a year but each engagement starts from a clean slate because there is no shared finding history. The client sees the same recurring issue flagged across three reports because the team cannot see that they wrote the same finding nine months earlier. Aging risk debt is invisible.
Renewal proposal written from a slide template
The renewal conversation runs from a template deck rather than the actual delivery record. Hours figures are estimated, engagement counts are guessed, and the client recognises the lack of evidence. The renewal is either undersold or quietly attritted to a competitor that promised the same shape with cleaner numbers.
How retainer management looks in SecPortal
Retainer management is one workflow stitched into four feature surfaces: the engagement record (parent and child), findings management, invoicing, and the branded portal. The retainer is structured rather than ad-hoc, and it produces a renewal conversation that runs from real delivery rather than from a slide template.
Parent record
The retainer lives on the client record under engagement management. Contracted block, term, rollover, overrun, SLA tier, and billing cadence are captured once at signing and inherited by every child engagement.
Drawdown ledger
Each child engagement records planned and actual hours or slots. The retainer balance updates per close, variance is flagged on the dashboard, and findings management history persists across engagements.
Invoicing
Bill on the contracted cadence through the integrated Stripe Connect invoicing. Line items reference the parent retainer and the consumed child engagements rather than free-text descriptions.
Renewal evidence the record carries by default
Renewals are won or lost on whether the firm can show the work. Five signals come straight off the retainer record without a manual recap pass and form the spine of the renewal proposal.
Hours consumed and remaining
The contracted block, the running drawdown across the term, and the remaining balance at the renewal window. The figure is the actual sum of engagement-level actuals rather than a finance-team approximation, so the conversation starts from one source of truth.
Engagements delivered with scope and outcome
A list of every engagement run under the retainer with the scope, the hours planned and actual, the headline findings, and the close-out status. The renewal proposal cites delivery rather than describing it.
Findings opened, closed, and aging
Across the full term, how many findings were opened, how many were closed, the average time to close by severity, and how many remain open against the client. The aging picture is the strongest argument for continuing the relationship; ignoring it is the strongest signal that the relationship was transactional.
Retests paired to original findings
Each retest tied to its original finding so the client sees verified fixes, partial fixes, regressions, and outstanding issues with the same identifiers across the term. The retainer becomes the audit trail of the security programme rather than a series of disconnected attestations.
SLA performance against the contract
How many engagements hit the contracted scheduling SLA, response SLA, and report turnaround SLA. Renewal pricing without this data is guesswork; with it, both sides negotiate from the same evidence.
Reviewer checklist for a healthy retainer
Before a retainer is treated as in good standing, the engagement lead and the account owner run through a short checklist. Each line takes seconds; missing any one of them is the source of the failure modes above.
- Retainer record contains contracted block, term, rollover policy, overrun policy, billing cadence, and SLA tier captured at signing.
- Each engagement under the retainer is opened as a child of the master record with planned and actual hours, not as a standalone job.
- Drawdown ledger updates per engagement close so the running balance is visible to delivery and finance from the same record.
- Variance between planned and actual hours is flagged on the retainer dashboard before the next engagement starts.
- Rollover and overrun decisions are recorded against the retainer with the approver and timestamp, not negotiated over email.
- Invoices reference the parent retainer and the child engagements consumed in the billing period rather than free-text descriptions.
- Findings, retests, and remediation status are visible across the full retainer term, not just within each engagement.
- Renewal proposal pulls hours, engagements, findings, retests, and SLA data directly from the record rather than from a recap deck.
Where retainer management sits across the engagement lifecycle
The retainer is the commercial parent layer above the engagement lifecycle. Each child engagement still runs scoping, kickoff, delivery, reporting, retest, and close-out as a normal pentest; the retainer carries the contract, the balance, the cadence, and the renewal evidence.
Upstream and downstream
The retainer parents pentest project management for each child engagement and retesting for verification. For always-on programmes, continuous penetration testing is the technical pattern often delivered under a retainer.
Onboarding and renewal
New retainers kick off through pentest client onboarding, advisory hours run through the security advisory request workflow so non-pentest consulting time draws against the retainer with a structured intake, and the parent record carries remediation tracking history across the term. At renewal, the report-ready record replaces the recap deck.
Pair the workflow with the long-form guides
Retainer management is operational; the surrounding guides explain the commercial trade-offs that show up at signing and at renewal. Pair this workflow with the writeup on pricing pentest services for retainer pricing patterns, the penetration testing as a service guide for the subscription-shaped delivery model, the pentest pricing models research for the commercial structures, and the aging pentest findings research for the risk-debt argument that underpins multi-year retainers, and the security testing programme management workflow for the operational parent layer that sits above the retainer when the buyer runs many engagements across many vendors, and the pentest vendor panel management workflow for the supplier-side governance layer when the buyer runs the retainer alongside other approved vendors on rotation.
Buyer and operator pairing
Pentest firms with a recurring book of business
Firms that sell quarterly or annual retainers to a portfolio of clients use the master record to keep delivery, billing, and renewal evidence on one timeline. The partner who signed the agreement and the consultant who runs the next engagement see the same balance, the same SLA tier, and the same outstanding findings.
MSSPs running ongoing security testing
MSSPs running security testing under a managed services umbrella benefit from the parent-child structure: the MSSP owns the retainer, child engagements draw down across services (pentest, retest, advisory), and the branded portal carries one identity per client across the full programme.
Security consultants with named-account retainers
Solo and small-team consultants who run retainers with a small number of named accounts get the same record-level rigour as a larger firm: contracted hours, drawdown, invoice cadence, and renewal evidence on the client record rather than across notebook pages.
Internal security teams running internal retainers
Internal security functions that bill business units through internal chargebacks model the chargeback as a retainer per business unit: contracted assessment slots, drawdown per request, and an attribution trail that the finance team can reconcile without a separate ledger.
Who runs this workflow
Retainer management is the commercial layer that pentest firms, MSSPs, security consultants, and freelance pentesters run on top of standard engagement delivery. The retainer is the relationship; the engagements under it are the work.
What good retainer management feels like
One ledger, no surprises
Delivery, finance, and the client read the same balance from the same record. The month-end true-up is reconciliation rather than discovery, and the next engagement is scoped against the actual remaining block rather than against a guess.
Renewals run on evidence
Hours consumed, engagements delivered, findings closed, retests run, and SLA performance come straight off the retainer record. The renewal proposal is built on real delivery, not on a recap deck written from memory three weeks before the term ends.
Retainer management is the workflow that decides whether a recurring book of pentest business compounds into a durable client portfolio or churns through annual renewals at a rate that the firm cannot diagnose. Get it right and each retainer is a self-documenting relationship that the next engagement and the next renewal can both build on; get it wrong and every renewal is a fresh negotiation against a missing record.
Frequently asked questions about pentest retainer management
What is a pentest retainer?
A pentest retainer is a contractual agreement under which a client pre-purchases a block of penetration testing capacity (hours, test count, or asset coverage) over a defined term. Individual engagements draw down against the block rather than being scoped and priced as standalone projects. The retainer carries the commercial relationship; the engagements under it carry the technical delivery.
How is a retainer different from continuous penetration testing?
Continuous penetration testing is the technical workflow of running an always-on programme: scheduled scans, live findings in a portal, retests paired to originals, and reports generated on demand from live data. A retainer is the commercial layer: the contracted block, the drawdown ledger, the billing cadence, and the renewal terms. The two compose: a continuous testing programme is often delivered under a retainer, but a retainer can also fund discrete project-shaped engagements that are not continuous.
What retainer structures does SecPortal support?
Retainers can be modelled as an hours block, a contracted test count, an asset-tier coverage commitment, or a hybrid of test slots plus an advisory hours pool. The retainer record captures the contracted block, term, rollover policy, overrun policy, billing cadence, and priority SLA. Child engagements draw against the block with planned and actual figures recorded at scoping and close.
How does retainer drawdown tracking work?
Each engagement opened against a retainer records planned hours or a planned test slot at scoping and the actual hours or slot consumption at close. The retainer balance updates automatically per engagement close, so the running balance is visible without anyone tallying figures in a finance spreadsheet. Variance between planned and actual is flagged on the retainer dashboard so the next engagement can be rescoped before it starts.
How are retainers invoiced?
The integrated Stripe Connect invoicing supports the common retainer billing cadences: a flat monthly retainer fee, a quarterly true-up against actual drawdown, or per-engagement drawdown invoicing. Invoice line items reference the parent retainer and the child engagements consumed in the billing period so the client gets one consolidated bill that ties to the delivery record rather than ad-hoc PDFs out of a separate finance tool.
How is retainer renewal handled?
The renewal conversation runs from the actual delivery record. The retainer page shows hours consumed, engagements delivered, findings opened and closed, retests paired to originals, aging issues, and SLA performance across the full term. The renewal proposal is generated against this evidence rather than against a recap deck, so renewal pricing is grounded in real delivery and the client sees the same picture the firm sees.
How does the retainer relate to project management and reporting?
Each engagement opened under the retainer behaves like a standalone pentest engagement in terms of project management, finding capture, evidence, AI reports, and branded portal delivery. The retainer is a parent layer above the engagements that carries the contractual and commercial state; the engagement layer carries the operational and technical state. Stakeholders work in the engagement view day-to-day and step up to the retainer view for balance, billing, and renewal.
Can a retainer carry findings and remediation history across engagements?
Yes. Findings, retests, and remediation history are visible at the client level across every engagement under the retainer. A finding that surfaces in a Q1 web app test is still tracked when the same asset is retested in Q3, so aging risk debt is visible across the full term rather than reset every engagement. The retainer becomes the durable record of the client security programme rather than a billing convenience.
How it works in SecPortal
A streamlined workflow from start to finish.
Open the retainer agreement on the client record
Capture the retainer parameters once: the contracted block (hours, test count, or asset tier), the term length, the rollover policy, the billing cadence, the priority SLA tier, and the named scope boundaries. The retainer lives on the client record so every engagement that draws against it inherits the same scope, ROE, and contact list rather than being rebuilt from a template each time.
Spawn engagements that draw down the block
Each pentest, retest, or advisory request opens as an engagement linked to the parent retainer. The engagement records its planned hours or test slot at scoping and its actual hours at close so the retainer balance updates automatically. Hours that overrun the planned figure are flagged on the master record before the next engagement starts, not at month end.
Run delivery on the engagement, not the retainer
Findings, evidence, AI reports, and the branded client portal sit on each child engagement, exactly as they would for a one-off pentest. The retainer carries the commercial relationship; the engagements carry the technical work. Stakeholders see the deliverable per engagement and the running balance per retainer without flipping between two systems.
Invoice on the agreed cadence
Bill the retainer at the contracted rhythm (monthly retainer fee, quarterly true-up, or per-engagement drawdown) through the integrated Stripe Connect invoicing. Invoice line items reference the parent retainer and the child engagements consumed in the period, so the client receives one consolidated bill rather than ad-hoc PDFs from a separate finance system.
Renew with a real history, not a slide deck
When the retainer term ends, the renewal conversation runs from the actual record: hours consumed, engagements delivered, findings closed, retests run, and remediation status across the full term. The history is the proposal evidence, so renewal pricing is grounded in delivery rather than in a recap document written from memory.
Features that power this workflow
Run pentest retainers as a record, not a spreadsheet
Track contracted hours, draw down across engagements, invoice on cadence, and renew with real history. Start free.
No credit card required. Free plan available forever.