Cyber Security Consulting: What You Get and What to Ask

Almost nobody decides to buy security consulting on their own. The decision arrives from outside: a customer attaches a 200-line security questionnaire to a renewal, an insurance broker sends back a form full of questions nobody in the building can answer, or somebody clicks something on a Friday and the week that follows makes the case by itself. Then three proposals land and they are impossible to compare, because one prices a two-week assessment, one prices a year of advice, and one prices a piece of software with an advisor attached.

The word "consulting" is doing almost no work in any of them. It covers a fixed-scope audit that ends in a report, a part-time executive, a penetration test, a compliance project with a deadline, and a sales motion for tools. Knowing which one you are being sold is most of the job of buying it well.

What Is Cyber Security Consulting?

Consulting is the part of the security market you buy when the question is "what should we do" rather than "who will watch this". A consultant looks at your systems, your suppliers, your policies and your people, forms a view about where the real exposure sits, and tells you what to change and in what order. The deliverable is judgment, written down.

That separates it from two neighboring markets with overlapping language. Managed services are operational: somebody runs a tool or a monitoring function on your behalf, continuously, for a monthly fee. Staffing is capacity: a contractor sits inside your team and does work you would otherwise hire for. Consulting is advisory, sold as an engagement with a start, an end and an artifact.

Three shapes cover almost everything sold under the label. Assessment measures the current state against something: a framework, a regulation, a customer questionnaire, or an attacker's likely path. Design produces a target state and a route to it, which is where architecture reviews and remediation roadmaps sit. Program work puts a named person in a leadership seat for a fixed number of days a month, usually called a virtual CISO. Most firms sell all three, and most proposals do not say which one you are being quoted.

Why the request comes from outside is worth naming, because it shapes what you should buy. The 2026 Verizon Data Breach Investigations Report found supply chain breaches up 60 percent, with breaches involving a third party now accounting for 48 percent of all breaches. Nearly half of incidents arrive through somebody's vendor, so every large buyer now polices its suppliers, and the questionnaire on your desk is that policy reaching you. An engagement scoped to answer the questionnaire is a different engagement from one scoped to reduce your risk, and both are legitimate as long as you know which you are buying. If you are earlier than that and still working out what a small company needs at all, the answer is usually controls before consultants.

What a Cyber Security Consultant Actually Does

Strip away the service menus and the work is consistent. A consultant collects evidence, interviews the people who actually run things, tests some of what they were told, compares the result to a standard, and writes it up with priorities attached. The variation is in scope and in who does the writing.

The five outer rings are the functions that have organized security assessments for over a decade. NIST added a sixth, Govern, when it published version 2.0 of the Cybersecurity Framework in February 2024, on the argument that cyber security is a source of enterprise risk senior leaders should weigh alongside finance and reputation, and it states the framework is designed for every size of organization, from the smallest schools and nonprofits to the largest agencies. Govern is ownership, budget, risk decisions and accountability. It is also what a 40-person company is missing when it thinks it is missing a firewall.

The services sold under the consulting label:

• Risk and gap assessment. Evidence review, interviews, a scored result against a framework, and a prioritized finding list.
• Compliance readiness. The same work aimed at a named standard, most often SOC 2 readiness, ISO 27001, HIPAA, PCI DSS or CMMC. Readiness is not the audit, and the firm that prepares you generally cannot be the firm that attests.
• Technical testing. Penetration testing, red teaming, cloud configuration review, application review. Priced per test rather than per hour.
• Architecture and design. Segmentation, identity, cloud landing zones, zero trust programs. Output is diagrams, standards and a build sequence.
• Incident readiness. Playbooks, a tested response plan, tabletop exercises, and a retainer that guarantees somebody answers when you call.
• Policy, training and program build. The document set an auditor or an insurer expects, plus the awareness program that makes it more than paper.
• Virtual CISO. A named senior person for a set number of days a month, owning the roadmap and sitting in front of your board and your customers.

What you receive is narrower than the sales conversation suggests: a findings report with severities, a remediation roadmap sequenced by effort and impact, an executive readout, and on the better engagements the evidence pack behind every finding. Nothing on that list changes a single setting in your environment. Somebody has to do the fixing, and who that is should be settled before you sign rather than discovered in week six.

What Cyber Security Consulting Does Not Include

The exclusions are where budgets get wrecked, because they are rarely written down and they all sound like things a security firm would obviously do.

A consultant does not watch your network. Detection and response is a staffed, round-the-clock function, sold separately as managed detection and response or built in-house, and no assessment substitutes for it. A consultant does not operate your tools: the report may say your endpoint software is misconfigured, and fixing it is a separate line item or your own team's weekend. A consultant is not your lawyer either. Breach notification deadlines, regulator correspondence and privilege over the investigation are legal questions, and in a real incident the sequence that protects you is counsel first, then the technical firm engaged through counsel. Nor is a consultant an auditor: readiness and attestation are different engagements performed by different firms for independence reasons.

One more exclusion is worth pricing in, because some of what consultants sell is available at no cost. CISA publishes Cyber Hygiene services, available at no cost, including continuous vulnerability scanning of internet-facing assets with weekly reporting, for US federal, state, local, tribal and territorial governments and for public and private sector critical infrastructure organizations. If you qualify, that is external scanning you should not be paying a consultancy a monthly fee to duplicate.

What a Consulting Engagement Looks Like

The shape is consistent across firms, and the durations are the part proposals leave vague. Ask for this sequence with dates attached before you sign anything.

Two rows carry most of the value and are the two most often missing. The draft findings review exists so a finding written from a misunderstanding gets corrected before it hardens into a severity your board sees. The retest exists so the engagement ends in evidence rather than intention, and it is far cheaper agreed at the start than bought as a change order in month four.

Your side has work too, and underestimating it is the usual reason an engagement slips. Somebody has to pull evidence, get people into interviews, and chase the third party that hosts the thing nobody in the building understands. Name that person in the statement of work with a rough hour count, because a consultancy waiting on exports still bills.

Types of Cyber Security Consulting Firms

The label covers six quite different businesses. They price differently, staff differently and fail differently, and matching the shape to the job matters more than comparing day rates.

Row four is the most common structure in the small business market and it is not automatically disqualifying. A firm that assesses you and then sells you the remediation has an obvious incentive, and plenty of them handle it honestly. Test it by asking which findings in their last three assessments were closed by something the firm does not sell.

How Much Does Cyber Security Consulting Cost?

Three pricing models are in the market and they answer different questions. Fixed fee buys a defined deliverable, which suits assessments and tests, and it makes scope the negotiation. Time and materials buys hours at a rate, which suits remediation support where nobody can predict the work, and it makes the estimate the negotiation. Retainer buys a block of days a month, which suits a virtual CISO or an incident response guarantee, and it makes the roll-over terms the negotiation. Ask which model each proposal uses and what happens when the work runs long, and the three quotes on your desk become comparable for the first time.

What moves the number is scope: how many systems, how many locations, how many cloud platforms, whether technical testing is included, how many frameworks you are measured against, and how senior the named people are. A firm that quotes without asking any of that is quoting a template.

Questions to Ask Before Hiring a Cyber Security Consultant

Every firm answers "do you have experience in our industry" the same way. These are the questions where answers actually differ, and where a vague answer is itself the finding.

What to Look For in a Cyber Security Consulting Contract

The statement of work is the product. Most disputes in this market are not about competence; they are about two parties who agreed to different scopes and did not notice until the readout.

• A scope boundary written as inclusions and exclusions. Systems, locations, cloud tenants, subsidiaries, third parties and time period, with the out-of-scope list as explicit as the in-scope one.
• Deliverables named as artifacts. "A findings report with severity ratings, an evidence appendix, a prioritized roadmap and two readout sessions" is a deliverable. "Expert guidance" is not.
• Key personnel, with a substitution clause. The named people appear, and swaps need your written agreement at equivalent seniority.
• Retest and rework rights. A retest window at a fixed price, and a rule that findings written from a factual error get corrected free.
• Report ownership and confidentiality. You own the report and may share it with customers, insurers and regulators. Some firms restrict distribution by default, which makes it useless for the questionnaire that started this.
• Data handling and evidence disposal. Where your evidence lives, who at the firm can see it, and a deletion date with written confirmation. You are handing a third party a map of your weaknesses.
• Independence and conflicts, in writing. Which products the firm resells, which vendors pay it, and whether the assessment team is compensated on downstream sales.
• Change control, termination and liability. How scope changes get priced and who approves them, the notice period, and whether the liability cap is a fraction of the fee or a number that means something.

One clause is worth adding that most buyers never think of. Agree what happens if the engagement uncovers an incident in progress. It happens more often than firms advertise, and the moment it does you need to know whether that consultancy can pivot to response, at what rate, and how the work moves under legal privilege. Settling it in the contract costs a paragraph and saves a day you will not have. If you have no plan for that day at all, the sequence in what to do when something has already happened is the shortest version.

When to Hire a Consultant Instead of Staff

The arithmetic is less about cost than about shape. A consultant gives you a wide skill set for a short time; an employee gives you a narrow skill set continuously. Buy the consultant when the work has an end, when it needs independence, when you need a specialism once a year, or when a board will hear something from an outsider that it will not hear from you. Hire when the work is daily and never finishes: patching, access reviews, alert triage, joiners and leavers, and the questionnaires that now arrive monthly.

The failure mode of consulting is a roadmap nobody executes. Every assessment produces one, and it dies quietly in a company where no employee owns it. Before you buy advice, name the person inside your business who will own the output and make sure they have the hours. If there is no such person, buy a virtual CISO or a managed service instead, because those come with somebody whose job is to keep going after the report.

Scope decides what an assessment can even find, which is the part buyers control and rarely think about.

How to Choose a Cyber Security Consulting Firm

Shortlist three and make them quote the same scope. Write a one-page brief yourself listing the systems, the framework, the deadline and the deliverables you want, and send the identical brief to all three. Comparable quotes beat any amount of research into which firm is better, because they force each one to reveal what it thinks the work is. Then weigh four things: whether the named consultants have done this in your sector, whether the sample report carries evidence rather than assertions, whether the credentials check out with the issuing bodies, and how the firm behaved while it was still selling. A firm that is slow or evasive before you have paid it will not improve afterward.