GBCORP BLOG · IT SERVICES
Cybersecurity Service Costs in 2026: Hourly Rates, Retainers, Scope
Cybersecurity is bought in four shapes, each priced differently. Knowing which shape fits the problem saves more money than negotiating the rate. Here is how the pricing works in 2026 and what a first engagement should buy.
Security services are sold by the hour, by the fixed-scope assessment, by the annual retainer and by the month as a managed service. The rate matters less than the shape: an hourly engagement is right for fixing known gaps, an assessment for finding them, a retainer for the day something goes wrong, and a managed service for watching around the clock. Most small and mid-sized firms need the first and third before the fourth.
The four pricing shapes
| Shape | Best for | GBCORP |
|---|---|---|
| Hourly engagement | Hardening, identity and access work, remediation of known issues | $250 an hour, minimum 40 hours |
| Fixed-scope assessment | Vulnerability assessment, penetration test, cloud configuration review | Quoted per scope |
| Incident-response retainer | Named responders, agreed response times, pre-agreed rates when an incident happens | Quoted annually |
| Managed detection and response | Monitoring, alert triage and response, around the clock | Quoted annually |
Across the market, consultant rates commonly run from about $150 to over $350 an hour depending on seniority and specialism, penetration tests for smaller estates often land in the five figures, and managed detection is usually priced per endpoint or per user each month. These are indicative ranges; the scope drives the number far more than the rate does.
What a 40-hour engagement buys
A minimum engagement of 40 hours, $10,000 at GBCORP’s rate, is enough for a focused first programme when the aim is to close the gaps attackers use most. A typical plan:
| Work item | What it covers | Typical hours |
|---|---|---|
| Identity and access review | Accounts, administrator rights, multi-factor coverage, dormant users | 8 to 10 hours |
| Multi-factor and single sign-on plan | Where it is missing and how to roll it out without disruption | 6 to 8 hours |
| Vulnerability scan and triage | External and cloud exposure, ranked by real risk | 10 to 12 hours |
| Backup and recovery check | Whether backups exist, are separated and actually restore | 4 to 6 hours |
| Incident-response plan and tabletop | Who does what in the first hour, rehearsed once | 6 to 8 hours |
The output is a ranked list of fixes, the most urgent ones already done, and a plan the business can follow. It is not a full audit, and it should not pretend to be one.
Why a retainer before an incident
An incident is the worst time to choose a responder, agree a rate and grant access. A retainer settles all three in advance: named responders who already know the environment, response times in writing, and rates agreed when nobody is under pressure. Insurers increasingly ask whether one is in place. For most firms it costs far less than a single day of uncontrolled incident response.
What not to buy first
Expensive monitoring on top of weak identity controls is the most common mistake: it produces alerts about attacks that multi-factor authentication would have stopped. The usual order is identity and access first, then backups that restore, then exposure reduction, then an incident plan, and only then continuous monitoring. Compliance frameworks such as SOC 2, ISO 27001 or PCI DSS add their own evidence work, which is priced as its own scope.
How to compare two quotations
Two security quotations rarely describe the same work, so compare them on scope before price. Put the deliverables side by side: which systems are covered, which tests are run, what the report contains, and whether fixing is included or only finding. Check who does the work: a senior engineer for the whole engagement, or a senior name on the proposal and junior staff on the keyboard. Ask how findings are ranked, because a report of two hundred items sorted by count is less useful than twenty sorted by the damage they could do. And ask what happens after the report: a quotation that ends at findings leaves the business to fix them alone, while one that includes remediation hours closes the gaps. The cheaper quotation is often the narrower one.
Six questions to ask any provider
- Which of the four shapes do you recommend for us, and why?
- What will the first 40 hours deliver, item by item?
- Who are the named responders, and what are the response times?
- How are findings ranked: by real risk or by count?
- What access do you need, and how is it removed afterwards?
- What does compliance evidence work cost, separately?
Questions we hear first
Is $250 an hour expensive?
It sits in the upper-middle of market rates for senior security engineers. The minimum engagement keeps the work focused on outcomes rather than hours.
Do small firms need a retainer?
Usually yes. It is the cheapest way to make sure someone qualified answers on the day of an incident.
Can you help with SOC 2 or ISO 27001?
Yes. Control monitoring, evidence collection and audit preparation are quoted as their own scope.
How quickly can you start?
An hourly engagement can start as soon as access is agreed; retainers begin with an onboarding review of the environment.
Where to start
The GBCORP Cybersecurity Solutions service is $250 an hour with a 40-hour minimum, with incident-response and monitoring retainers quoted annually. The GBCORP IT services pillar sets out the wider offer, and cybersecurity services in 2026: what to buy first covers the order of purchases in more depth.
GBCORP operates across 17 countries on 4 continents through six pillars: AI & IT, Innovation, Sustainability, Infrastructure, Premium Business, and EV's & Solutions.
