Security Assessment to Ongoing Client Program

Turning a one-time security assessment into an ongoing client program means shifting from a point-in-time report to a continuous cycle of testing, remediation, and improvement. You start with the initial assessment as the baseline, then build a repeatable schedule of re-tests, monitoring, and reporting that keeps the client’s security posture current. This article explains how to structure that transition, what to include, and how to avoid common pitfalls.

Formula

Annual program cost = (hours per re-test × hourly rate × scope factor) × (12 ÷ assessment interval in months).

• r – hours of work per re-test session (includes prep, testing, reporting).
• h – hourly billing rate in your currency.
• s – scope factor: 1.0 if the same scope as the original, 1.5 if the client added new systems, 0.5 if you’re only re-testing a subset.
• t – months between re-tests (e.g., 3 for quarterly, 6 for semi-annual).

The result is the total annual cost of the ongoing program, assuming the same hourly rate and a consistent scope.

Worked Example

Using the defaults: 3-month interval, 8 hours per re-test, $150/hour, scope factor 1.0.

1. Re-tests per year = 12 ÷ 3 = 4.
2. Cost per re-test = 8 × $150 × 1.0 = $1,200.
3. Annual cost = $1,200 × 4 = $4,800.

The calculator shows $4,800/year for four re-tests. If you switch to monthly (t=1), the cost jumps to $14,400/year – that’s the trade-off between frequency and budget.

Why Move to an Ongoing Program?

A single assessment is a snapshot. It tells you what was vulnerable on the day you tested, but it doesn’t account for new code, new employees, or new attack techniques. An ongoing program provides:

• Continuous visibility – you catch issues before they become breaches.
• Better budgeting – predictable annual cost instead of surprise emergency tests.
• Improved compliance – many standards (PCI DSS, SOC 2, ISO 27001) require regular testing, not just one.
• Stronger client relationship – you become a trusted partner, not a one-off vendor.

How to Structure the Program

Start by defining the scope and frequency. The initial assessment should be thorough – it’s the baseline. Then decide what each re-test covers. A common approach:

1. Quarterly re-tests – full scope, but with a focus on changes since the last test.
2. Monthly or continuous scanning – automated vulnerability scans, not manual testing.
3. Annual deep dive – a full reassessment, including new attack surfaces.

Document everything: what was tested, what was found, what was fixed, and what’s still open. Use a shared dashboard so the client can see progress in real time.

How to Choose the Right Frequency

There is no one-size-fits-all. Consider these factors:

• Rate of change – if the client deploys new code weekly, monthly re-tests make sense. If they’re static, quarterly may be enough.
• Compliance requirements – some regulations mandate specific intervals (e.g., quarterly external scans for PCI).
• Risk tolerance – a financial institution needs more frequent testing than a local bakery.
• Budget – the calculator above shows the cost difference; make sure the client understands the trade-off.

A good starting point is quarterly re-tests with a monthly automated scan. Adjust based on findings – if you keep finding critical issues, increase frequency.

Common Problems and How to Avoid Them

• Scope creep – the client adds new systems mid-cycle. Use a scope factor in your pricing and have a change-order process.
• Finding the same issues every time – that means the client isn’t fixing things. Build remediation into the program: include a follow-up verification test after fixes.
• “We’re too busy” – the client delays re-tests. Automate what you can and set clear deadlines in the contract.
• Report fatigue – 50-page reports every month get ignored. Provide an executive summary with a risk score and a prioritized fix list.

Comparison: One-Time vs. Ongoing

Aspect	One-Time Assessment	Ongoing Program
Cost	Single payment	Recurring, but predictable
Coverage	Point-in-time	Continuous
Remediation	Client’s responsibility	Built-in verification
Relationship	Transactional	Partnership
Compliance	May not satisfy ongoing requirements	Often required

Ongoing programs cost more per year, but they prevent costly breaches and reduce the client’s overall risk.

Costs and Pricing Models

Pricing can be a flat annual fee, per-session, or a retainer. The calculator above uses a simple per-session model. In practice, you might offer:

• Flat annual fee – covers a set number of re-tests and hours; easy for the client to budget.
• Per-session – flexible but less predictable.
• Tiered packages – e.g., Bronze (quarterly scans), Silver (quarterly + manual re-tests), Gold (monthly + full annual).

Make sure the contract defines what’s included: hours, scope, reporting, and remediation verification. Overruns should trigger a change order.

Safety and Accuracy in Testing

Always get written authorization before testing. Use a controlled environment or a staging copy if possible. For live systems, schedule tests during low-traffic hours and have a rollback plan. Never run destructive tests without explicit approval. Document all actions – this protects both you and the client.

Alternatives to a Full Program

If the client can’t commit to a full program, suggest:

• Automated vulnerability scanning – a tool that runs weekly and alerts on new issues.
• Annual assessment plus quarterly scans – a middle ground.
• Self-service portal – give the client access to a dashboard with checklists and guidance.

These options are cheaper but less thorough. Be clear about the limitations.

Frequently Asked Questions

How much should an ongoing security assessment program cost?

It depends on the scope, frequency, and hourly rate. Using the calculator, a quarterly program with 8 hours per re-test at $150/hour costs about $4,800/year. Adjust the inputs to match your situation.

What’s the difference between a vulnerability scan and a penetration test?

A vulnerability scan uses automated tools to find known weaknesses. A penetration test involves a human trying to exploit those weaknesses to see how deep an attacker could go. Ongoing programs often include both – scans monthly, pen tests quarterly or annually.

Can I start with a one-time assessment and upgrade later?

Yes. Many providers offer a “first assessment” that includes a roadmap for an ongoing program. The initial report should include a recommended schedule and pricing for re-tests.

What if the client doesn’t fix the issues found?

Include remediation verification in your contract. If the client ignores findings, document it and escalate. You can also include a clause that limits your liability if the client fails to act.

How do I handle new systems added during the contract?

Use a scope factor in your pricing, as shown in the calculator. For example, if the client adds 50% more systems, the scope factor becomes 1.5. Alternatively, charge a change order for each new system.

What compliance standards require ongoing testing?

PCI DSS requires quarterly external scans and annual penetration tests. SOC 2 requires continuous monitoring and annual assessments. ISO 27001 requires regular internal audits and annual reviews. Always verify the current requirements with the relevant body.

Related

• AI Assistant Email Permissions: Safe Setup Guide
• Assess Internet-Facing FortiGate TLS Certificates
• Flipkart QR Code Payment: How It Works

in t | Assessment interval (months) | months | 3 | 1 | 12
in r | Hours per re-test | hours | 8 | 1 | 40
in h | Hourly rate ($) | $ | 150 | 0 | 500
in s | Scope factor (1 = same) | - | 1 | 0.5 | 3
out cost | Annual program cost | $/year | (r * h * s) * (12 / t) | 0
out sessions | Re-tests per year | - | 12 / t | 1