Security Retainer Renewal Evidence Pack (Retention)

Security Retainer Renewal Evidence Pack (Retention)

1. 01

   Pull the last 90 days of scan and alert history for the client account before the renewal conversation is scheduled

   Export findings from whichever scanners sit in the stack (Sentrint for repository secrets and dependency risk, hCaptcha for bot and account-takeover traffic) into one timeline so the renewal deck cites events, not adjectives.

2. 02

   Convert raw findings into a count of prevented or contained incidents

   State how many leaked credentials were caught pre-deploy, how many bot spikes were blocked, and how many policy violations were reversed; a retainer defended with three concrete saves outperforms a page of uptime percentages.

3. 03

   Re-baseline the client's attack surface against the day-one intake record

   Note new domains, new AI agents, and new third-party integrations added during the term, since each one widened the surface the retainer is priced against.

4. 04

   Document every agent and automation permission granted during the term and confirm each is still at minimum scope

   Agents that broke out of test environments and reached external systems this year show why standing permissions deserve a line item in the renewal pack rather than a footnote.

5. 05

   Attach a written scope boundary that names what the retainer does not cover

   List exclusions explicitly (zero-day exploitation, client-side misconfiguration outside managed systems, losses from vendor outages) so renewal does not silently convert into an absolute security guarantee.

6. 06

   Price the next term against measured effort, not the original estimate

   Compare hours logged on triage, patching, and reporting to the contracted allowance; where overage is consistent, propose a tier change instead of absorbing it again.

7. 07

   Hand the client a one-page forward plan for the coming quarter

   Sequence the next three security workstreams (for example deepfake and synthetic media verification via Resemble AI, or encrypted client file exchange through Tresorit) so renewal reads as a roadmap, not a renewal invoice.