How To Accept Payments For An Information Security

An information security business sells retainers, assessments, and incident response, and the last one is unlike anything else in this series: the client calls in a crisis, needs work started immediately, and has not signed anything. How you handle that hour decides whether you get paid. Here is the setup.

Current as of July 28, 2026. Data changes; this page is reviewed quarterly.

How security money actually arrives

Four flows. Retainers for ongoing monitoring, advisory, and managed services, billed monthly, which is the recurring core. Assessment projects: penetration tests, audits, and compliance readiness work, billed at milestones. Incident response, either on a pre-agreed retainer or as an emergency engagement at premium rates. And remediation or implementation work following an assessment, which is often the larger engagement.

By the numbers (July 28, 2026)

Rate that applies: 3.3% + 30¢ online or on a card-paid invoice, per Square's 2026 US pricing. A $18,000 incident response engagement carries $594 in fees; by ACH bank transfer (1%, capped at $10) it costs $10.00, a $584 difference. Agreed and part-paid before substantive work begins, because leverage in an incident never improves after the first hour.

Sell incident response retainers in calm weather

An organisation in the middle of a breach is not in a position to negotiate a contract carefully, and a firm starting work without one is exposed on scope, liability, and payment simultaneously. The answer is the pre-agreed retainer: a signed agreement, agreed rates, and defined response terms established before anything happens, with a modest annual fee that buys guaranteed availability. Clients buy it because it is cheap insurance, and firms sell it because emergency engagements agreed at two in the morning are the ones that end in disputes.

Emergency engagements, when there is no retainer

Where a new client calls mid-incident, get a signed engagement letter and a payment before substantive work begins, even a partial one, because leverage never gets better than it is in that first hour. Premium rates for emergency work are standard and should be stated rather than apologised for. Be explicit about scope: incident response, forensic investigation, and remediation are different engagements with different costs, and a client under pressure will hear all of it as fixing the problem unless you separate them in writing.

Assessments, scope creep, and findings nobody wanted

Penetration tests and audits are scoped in advance and the scope is where the money is. Define what is in and out, state what happens if the assessment uncovers something outside it, and price remediation separately rather than letting it be absorbed into the test. There is also a commercial reality worth naming: a client who receives findings they did not expect sometimes wants to negotiate the invoice, which is why payment terms and milestones should be agreed before the report is written rather than after.

Retainers, corporate payables, and the rails

Monthly retainers should charge automatically on a stored method or bank arrangement on a fixed date, with the scope defined so out-of-scope work is quoted rather than absorbed. Corporate clients pay through accounts payable needing purchase orders and specific invoice detail, so establish that at onboarding. On rails, retainers and smaller assessments suit card where convenient, while incident response and large project invoices belong on bank transfer, and in an emergency the client's ability to pay immediately by card is sometimes exactly why card acceptance matters.

Sources

• NerdWallet — Square Fees: Calculator and Pricing for 2026
• Swipesum — Square Fees Explained 2026 (verified against Square's published pricing)

What people ask me

Why sell incident response retainers in advance?

Because an organisation mid-breach cannot negotiate carefully, and a firm starting without an agreement is exposed on scope, liability, and payment at once.

What if a new client calls mid-incident?

Get a signed engagement letter and a payment before substantive work begins, since leverage never gets better than it is in the first hour.

How should emergency scope be handled?

Explicitly in writing, since incident response, forensic investigation, and remediation are different engagements that a client under pressure hears as one thing.

Where do assessments lose money?

Scope. Define what is in and out, state what happens if something outside it is found, and price remediation separately rather than absorbing it.

Why agree terms before the report?

Because a client receiving unexpected findings sometimes wants to negotiate the invoice, which is far harder once the report is written.

Heads up: some links here are affiliate links. If you buy through one, I may earn a small commission. It costs you nothing extra. I only recommend tools I use myself.