From project work to retainer
Turning a $15,000 CAD assessment into a $5,000 CAD monthly retainer takes the same client from $15,000 of revenue to $135,000 over two years. It is the largest margin change available to a small practice, and it is not right for everyone.
A consultancy selling one-off assessments earns roughly $53,000 CAD from a good client over two years: the first assessment and the two follow-on pieces of work a happy client usually buys. The same client on an assessment plus a $5,000 CAD monthly retainer is worth about $135,000 CAD over the same period, and the second number arrives without a second sale.
What does converting one client actually earn?
Cumulative revenue from one mid-market Canadian client over 24 months, on both paths. The project path assumes a $18,000 CAD assessment, a $15,000 CAD follow-on at month 12 and a $20,000 CAD project at month 20, which is better than average for project work. The retainer path assumes a $15,000 CAD assessment then $5,000 CAD a month.
| Month | Project path | Retainer path | Difference |
|---|---|---|---|
| 0 | $18,000 | $15,000 | -$3,000 |
| 6 | $18,000 | $45,000 | $27,000 |
| 12 | $33,000 | $75,000 | $42,000 |
| 18 | $33,000 | $105,000 | $72,000 |
| 24 | $53,000 | $135,000 | $82,000 |
| Two years, one client | $53,000 | $135,000 | 2.5 times |
The retainer path starts behind, which is the part firms forget. You give up $3,000 CAD on the first invoice because a client committing to twelve months wants something for it, and you are still behind at month three. Crossover here is month four. In a practice with a thin cash position that gap is why the switch is easier from a book of several project clients than from one.
The number that changes is sales cost
Project work needs a new sale for every dollar of revenue. The project path above took three sales over two years, the retainer path one. At $6,000 CAD of time and effort to win an engagement, the project path spent $18,000 CAD selling to a client the retainer path sold to once. That is a bigger margin change than the revenue difference.
How do you convert an assessment into a retainer?
The conversion is designed into the assessment, not attempted after it. An assessment that ends with a list of findings invites the client to go and fix them. One that ends with a roadmap, dates and a named owner per item raises the question of who owns the plan. The answer is a retainer.
- Sell the assessment as the first phase of something, not as a deliverable. Say in the proposal that it produces a roadmap and that the roadmap needs an owner. Clients are not surprised by this and they resent it far less than a pitch delivered at the readout.
- Write the roadmap with dates and owners. A finding without a date is a document. A finding with a date and no internal owner is a job opening you are qualified for.
- Present the readout to whoever controls budget, not only to the person who hired you. The engineering lead who commissioned the assessment usually cannot approve a recurring cost.
- Quote the continuation in the readout meeting, while the findings are on the screen. Two weeks later the urgency is gone and the roadmap is a file.
- Offer 90 days rather than 12 months. A quarterly commitment is inside most people's approval authority and an annual one usually is not, and a client who renews at day 90 renews at day 180.
- Put the renewal decision on a date, in the contract, with a written quarterly summary of what the retainer produced. Retainers do not die of dissatisfaction, they die at a renewal nobody could justify.
The second most reliable conversion is the framework client. A company that hired you to get through SOC 2 or ISO 27001 bought a certificate, not a relationship, and cancels the month the report lands unless the engagement was framed from the start as holding the position rather than reaching it. Surveillance audits, annual Type 2 windows and evidence that has to keep accumulating are reasons to continue. Put them in the original proposal, not in month eleven.
Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.
Pricing the switch without losing money
The trap is discounting the retainer against your project rate to make the commitment attractive, then finding the retainer consumes project-level hours. Retainer work in Canada carries an effective rate of $250 to $375 CAD an hour against $300 to $400 CAD for project work, and that spread is the right size. Widen it and you have sold two years of capacity cheaply. What to exclude and when to raise the fee is on pricing a vCISO retainer.
When projects are genuinely the better business
Retainers cap your upside, and that is the part recurring-revenue advice skips. A retainer is a commitment to be available at a known price, so a month where you produce something extraordinarily valuable pays the same as a quiet one. Project work has no such ceiling.
| Question | Project work | Retainer |
|---|---|---|
| Effective hourly rate | $300 to $400 CAD | $250 to $375 CAD |
| Revenue predictability | Rebuilt every quarter | Known 3 to 12 months out |
| Sales effort per dollar | High and repeating | Paid once |
| Ceiling on a great month | None | The retainer fee |
| Effect of one client leaving | Absorbed, work was ending anyway | An immediate hole in the month |
| Ability to say no to bad work | High | Falls as retainer concentration rises |
| What it is worth if you sell the practice | Little | The main thing a buyer values |
Some practitioners earn more on projects, usually the ones with a scarce specialism: incident response, post-breach remediation, regulatory response, security diligence on an acquisition. That work is bought under time pressure by people who are not price sensitive, at rates a retainer cannot approach. If your calendar fills with $40,000 CAD engagements clients need next week, converting to $5,000 CAD a month is a downgrade dressed as a business model.
The test is whether your project pipeline is inbound and urgent. If clients arrive with a deadline and a problem, keep selling projects and raise your rate. If you spend the first month of every quarter finding the next engagement, the retainer is worth the ceiling it imposes. Where the pipeline comes from either way is on how to get vCISO clients.
The mixed book, which is what most practices end up with
Few Canadian practices are purely one or the other. Aim for enough retainer revenue to cover fixed costs and a floor income, with project work above it. Four retainers at $6,000 CAD a month is $288,000 CAD of committed annual revenue, which for a one or two person practice covers the year and makes every project after it optional. Work you can price properly and decline changes the practice more than the revenue does.
Watch concentration as it builds. A practice where one retainer is more than 30 percent of revenue is not running a business, it is holding a job with worse employment protection, and the client will eventually work out what that gives them at renewal.
Put your practice in the directory
Companies use this site to find fractional security leadership in Canada. A listing is free, you keep it current yourself, and enquiries matched to you cost nothing.
List your firmCommon questions
How do I turn a one-off security assessment into a retainer?
Design the assessment to end in a roadmap with dates and owners, present it to whoever controls budget, and quote the continuation in the readout meeting itself. Offer 90 days rather than a year, because a quarterly commitment sits inside most people's approval authority. Waiting until the project ends to raise the idea converts far worse than building it into the original proposal.
Is retainer revenue really worth less per hour than project work?
Yes, by roughly $50 to $75 CAD an hour in the Canadian market, and that discount is what the client is buying. It is still the better business for most practices because sales cost per dollar of revenue collapses, but anyone telling you retainers are better on every measure is not counting the rate you gave up.
How much retainer revenue should a small practice aim for?
Enough to cover fixed costs and a floor income, which for a one or two person Canadian practice is usually three to five retainers at $5,000 to $8,000 CAD a month. Past that, more retainers mostly buy predictability you already have while consuming the capacity that higher-rate project work needs.
Why do clients cancel a retainer after a certification?
Because they bought the certificate and you sold them the certificate. A retainer framed as the route to a SOC 2 report has no obvious purpose once the report exists. Frame it from the first proposal as maintaining a position, name the surveillance audit or the next Type 2 window, and the renewal conversation has an answer in it.
Should I discount the retainer to get the client to commit?
Discount the term or the assessment, not the monthly fee. The monthly figure is the one number you cannot raise later without a renegotiation the client resents, and a retainer priced low at the start stays low for as long as the client stays. Shortening the minimum commitment costs you far less and closes just as well.