Selvum

Security work is moving from one-off incident cleanup to recurring advisory retainers, because AI-generated code and autonomous agents have expanded the attack surface faster than client IT teams can staff for it. Agencies that bundle threat modeling, code scanning, and agent governance into a monthly line item capture margin that survives project churn; those that treat security as a favor lose the account the first time a leaked key produces a four-figure bill.

Liability Ceiling is the maximum exposure an agency accepts when it sells security as an outcome rather than as a process. Every retainer that promises "we will keep you secure" converts an evolving attack surface into a contractual obligation the agency cannot fully control. The framework asks one question before signing: what is the worst-case dollar figure if this control fails, and who pays it? Agencies that sell detection, monitoring, and documented response steps cap their exposure at labor and tooling cost. Agencies that sell guarantees inherit the breach. A documented case from September 2026 shows a vibe-coded client app with exposed API keys generating a $4,000+ unauthorized usage bill, small enough to absorb but proof that the failure mode is financial, not theoretical. Set the ceiling in the statement of work: name the controls in scope, the review cadence, and the response time, then price the retainer against that scope instead of against an outcome you cannot underwrite.

Blast Radius Budget treats every automated workflow as a spend of trust: the more autonomy an agent gets, the smaller the radius of damage it must be able to cause before a human checkpoint fires. Agencies scope security not by counting tools but by mapping what each automation can touch (client CRM records, ad accounts, production repos, payment keys) and capping the worst-case outcome. A workflow that drafts copy can run unattended; one that sends client-facing email or rotates credentials cannot. The budget is set per client, per retainer tier, and reviewed when scope expands. The failure mode is real: exposed API keys in AI-built client apps have produced bills above $4,000 from unauthorized calls, a cost that lands on the agency's invoice and reputation, not the model vendor's. Pair the budget with runtime controls such as Vaultak's action interception or Cogent's attack-path mapping so the cap is enforced, not just documented.

Trust Premium Decay treats every security promise an agency makes as a depreciating asset rather than a fixed credential. A SOC 2 badge, an encrypted client portal, or a clean scan earns trust at signature, then loses value as attack surfaces change and the evidence behind the claim ages. Agencies that re-verify on a cadence keep the premium; those that coast on a one-time audit watch it erode quietly until an incident reprices the whole retainer. The framework forces a simple question at renewal: what did we prove this quarter, and when? A concrete example sits in the $4,000+ API bills traced to exposed keys in AI-built client apps, where a single leaked credential converts a trust asset into a liability line item overnight. Pairing periodic re-verification with incident response keeps the premium compounding instead of decaying.

Split every security engagement into a fixed-fee detection and hardening deliverable plus a separately contracted advisory layer, and never let a retainer contract contain the words guaranteed, secure, or protected without a written scope boundary.

Buy the enforcement layer first and the detection layer second, because a tool that can block or reverse an agent action is worth more to a retainer than one that only files a finding.

IF your agency already holds recurring access to client infrastructure, repositories, or marketing data pipelines, THEN sell a proactive threat-modeling retainer that bundles vulnerability scanning, secret hygiene, and access review into the existing monthly scope. IF clients only call after a breach, a leaked key, or a compliance questionnaire lands, THEN keep security as a reactive, project-priced incident response engagement and avoid promising continuous coverage you cannot staff.

A productized security engagement that maps client attack paths, closes the highest-severity gaps, and leaves a documented incident response runbook the agency can operate on retainer.