WCAG Repair

WCAG Repair scans against WCAG 2.1 and 2.2 AA with axe-core and returns an AI remediation guide in about 2 minutes, so an agency can quote an audit before a prospect finishes describing the problem. The economics shift when that one-off audit becomes monitoring: the vendor's own entry point is $7/month for recurring clients, while the SMB Starter offer resells at $399/mo on 8h setup plus 2h/mo. The catch is scope, since automated testing only catches issues like missing alt text, contrast failures, and broken ARIA, not the judgment calls a human auditor still has to make.

WCAG Repair's pricing creates a natural upgrade path for agencies. The Complete Site Audit costs $29 one-time and bundles the Site Health Report, Security Remediation Guide, and AI Readiness assessment. The SMB Starter retainer runs $399/mo with 8h setup and 2h/mo, covering monthly rescans, priority code fixes, and a branded compliance report. The bridge works because the $29 audit surfaces the exact violations that justify ongoing monitoring: a clinic site with missing alt text and contrast failures gets a remediation guide, then a monthly retainer to keep those fixes from regressing. Agencies selling one-off audits at $29 leave the recurring revenue on the table. The margin sits in the retainer, not the scan. Position the audit as a paid diagnostic and the retainer as the compliance maintenance contract. The 10-page free scan limit means most client sites need the paid tier before you can even quote the retainer.

Every security retainer carries an implicit liability ceiling: the gap between what an agency promises and what an attack surface can actually guarantee. Agencies that sell "we will keep you secure" absorb unlimited downside; agencies that sell defined detection, response, and remediation scopes cap their exposure while still charging recurring fees. The framework asks three questions before signing: what specific asset is protected, what detection window is promised, and who owns the residual risk when a novel attack path emerges. Cogent's VR-1 model maps attack paths across enterprise infrastructure, which reframes the deliverable from "prevention" to "path visibility," a bounded promise. Sentrint grades repository security and generates fix prompts, giving clients a measurable artifact rather than an assurance. Vaultak monitors and rolls back AI agent actions in production, another bounded scope. California SB 813 and AB 1405, signed September 9, 2026, formalize third-party AI audit expectations, which pushes agencies toward documented, auditable scopes instead of blanket guarantees.

Blast Radius Budgeting treats security scope as a function of how much damage a single compromised asset can cause, not how many assets exist. An agency protecting a 40-person client with one shared drive has a smaller blast radius than a 12-person client whose AI agents hold production database credentials. The framework asks three questions per engagement: what can be reached from the weakest credential, how fast can it be revoked, and who eats the loss if it is not. That third question is the pricing lever. Runtime governance layers such as Vaultak intercept agent actions and roll them back automatically, which shrinks the radius and justifies a lower liability premium; frontier reasoning models like Cogent map attack paths across the same infrastructure, which expands the billable discovery phase. California SB 813 and AB 1405, signed September 9, 2026, now formalize third-party audit expectations, so documented radius estimates become client-facing evidence rather than internal notes.

Adopt WCAG Repair when a client contract or sales motion requires documented accessibility compliance, and price the remediation guide as the deliverable rather than the scan itself.

Scope every security engagement as detection, evidence, and response support, and never contract for absolute protection.

IF your agency already sells recurring website work to clients in regulated sectors and can absorb an 8h setup plus 2h/mo per account, THEN buy WCAG Repair and resell the $399/mo SMB Starter retainer, because the $8.99 Accessibility Guide and $29 Complete Site Audit one-offs are too thin to carry a service line alone. IF your delivery team cannot manually verify the axe-core findings before signing a compliance certificate, THEN skip, because WCAG Repair only catches automated-testable issues and the certificate still carries your agency's name.

A productized accessibility service that turns WCAG Repair's axe-core scans and AI remediation guides into a monthly ADA, Section 508, and EAA compliance retainer for agency clients.