Security Tools Rule: Price the Liability Before You Price the Retainer
Which security work can an agency sell as a defined deliverable, and which parts must stay advisory so the agency never carries breach liability it cannot absorb? Split every security engagement into a fixed-fee detection and hardening deliverable plus a separately contracted advisory layer, and never let a retainer contract contain the words guaranteed, secure, or protected without a written scope boundary.
By InnovaAI ResearchPublished Updated
“Which security work can an agency sell as a defined deliverable, and which parts must stay advisory so the agency never carries breach liability it cannot absorb?”
Split every security engagement into a fixed-fee detection and hardening deliverable plus a separately contracted advisory layer, and never let a retainer contract contain the words guaranteed, secure, or protected without a written scope boundary.
Treating security as a feature line on a retainer and implying the agency will keep the client safe, then discovering after an incident that the contract language, not the tooling, determines who pays.
The category spans very different risk profiles: Cogent's VR-1 model maps attack paths across enterprise infrastructure and can drive autonomous remediation, while Sentrint scans repositories for leaked credentials and dependency risk and returns a weighted grade rather than a fix guarantee. That gap matters commercially because exposed API keys in AI-built apps have produced documented bills above $4,000 charged to the app owner, a cost that lands on whoever shipped the code. Meanwhile 83% of B2C marketing decision makers already work with AI agents, so agencies are wiring automations into client systems faster than they are writing liability terms around them.
- •A client asks the agency to sign off on the security posture of a deliverable the agency built or shipped
- •The proposed scope includes any promise of protection, prevention, or guaranteed uptime against attacks
- •Client-facing apps or automations were produced with AI coding tools and no secrets review has run
- •The agency is bundling threat modeling or incident response into an existing monthly retainer
- •A client wants agent or automation workflows connected to CRM, ad accounts, or payment systems