The revenue you're already turning down
A client ships an AI feature and asks whether it is safe to expose. Another gets a pentest report back and wants to know who fixes the 40 findings in it.
Today you refer the work out and hand a trusted relationship to another vendor, or you take it in-house and carry the liability yourself.
Saying no costs the most. That client starts shopping for a partner who covers more of their stack, and the rest of your retainer goes with them.
The math on one attach
Move the sliders to your own numbers. The defaults show a common starting point: three existing clients, a $4,000 monthly line item, and a 40% margin.
Partner ROI calculator
Your numbers · updates liveDelivery cost runs only while the client pays. No salary, no bench, no tooling licenses on your P&L.
Versus building the capability yourself
Hire a senior AppSec engineer
- Fixed six-figure salary plus benefits, owed whether or not clients buy
- Three to six months of search before anyone starts
- Scanner and tooling licenses paid a year up front
- You pay for the gaps between engagements
- One person, one skill set, and a single point of failure when they leave
White-label the delivery
- You pay for delivery only while a client pays you
- You can put it in a proposal this quarter
- Tooling and methodology come with the engagement
- Scale up per client won, scale down without a layoff
- A public delivery record you can show a client before you sell
Three ways partners run it
-
Model 01
Back of house
I never appear. You get scoping help, proposal language, technical review, and the finished deliverable in your template. Best for firms that keep the client relationship closed.
-
Model 02
Your security lead
I join client calls under your brand with your email address, run the technical conversation, and hand findings back through you. Best when the client wants to see a specialist.
-
Model 03
Standing retainer
Fractional security capacity across your whole book: PR gates, reviews, and incident support on demand. Best once two clients are attached.
The attach map
Each row below is a trigger that already happens inside your accounts. The offer gives you something to say when it does.
| You already sell | The trigger moment | What you attach | Typical band |
|---|---|---|---|
| Custom app & SaaS builds | Client signs their first enterprise logo and inherits its security bar | Pre-launch AppSec review, then a secure-SDLC gate on the build | $6K–12K + retainer |
| Managed IT / cloud ops | Client moves workloads to AWS or standardizes on GitHub Actions | CI/CD hardening and cloud cost-and-risk retainer | $3K–5K/mo |
| Pentests & assessments | Report lands and the client asks "so who fixes this?" | Remediation delivery: you find it, I fix it, you re-test | $4K–8K/mo |
| AI features & agent builds | Client puts an LLM or agent in front of real users | AI/MCP threat model and prompt-injection guardrails | $8K–15K project |
Bands are starting points for a scoping conversation. Final pricing depends on repo count, stack, and cadence.
What your client receives
-
Findings that survive scrutinyI trace which issues an attacker can reach and hand over the twelve that qualify out of eight hundred, each with a proof their engineers can run. No more 800-row spreadsheets.
-
Pipelines that stop leakingI pin actions, close injection paths, and cut token scope. Their builds finish faster and the Actions bill drops.
-
Gates on every pull requestI wire SAST, DAST, IaC, and secrets checks into CI, with gates tuned to block exploitable risk at the pace their team ships.
-
AI & MCP security reviewsI threat-model agentic systems, build prompt-injection guardrails, and check the MCP supply chain. No scanner on the market covers it.
-
Supply-chain controlI pin their dependencies, produce an SBOM on every build, and flag the packages that reach production. They hear about a compromised release the week it ships.
-
Reporting the buyer understandsExecutive summaries in business terms: risk reduced, spend avoided, deals unblocked. Your logo sits on top of them.
How the partnership works
- The relationship stays yours. You own the client, the contract, the billing, and the margin. I work through you, under NDA, in your channels, with your branding on the deliverables.
- Bring me in before you quote. I size the work with you and say so when a piece of it is not worth selling.
- Start with one account. One engagement is the proof. Attach the second once your team has seen the delivery and the client renewal.
- Three-month minimum per engagement. Findings, build time, and cloud spend take a quarter to move. Anything that shows up in week three is cosmetic.
- Limited partner slots. Delivery quality is the product, so I run a small number of partners at a time.
Each fix I've landed upstream is public. See the merged work →
Bring one client to the call
Pick the account most likely to buy this and we'll scope it live: your cost, your price, and whether the attach is worth making. Thirty minutes.