Advisory retainers
You should know what you are paying for before the first call. Each package reserves senior technical security capacity, with the working rhythm and limits stated upfront.
Rates are in Malaysian Ringgit and exclude SST where applicable. If the work is better handled as a project, we will say so and quote it separately before anyone starts.
Monthly retainers
The right tier depends on how often your team needs review, how many systems are in play and how quickly a senior response is needed.
Indicative USD/SGD pricing
Founder-led and small technical teams with a handful of security decisions each month.
Monthly retainer
RM3,500/month
Up to 4 advisory hours per month
Recommended
Software teams and IT-heavy SMEs shipping regularly without an in-house security lead.
Monthly retainer
RM7,500/month
Up to 10 advisory hours per month
Active product teams, higher-risk systems or programmes with several technical owners.
Monthly retainer
RM13,500/month
Up to 20 advisory hours per month
MSPs, software houses and larger teams that need regular senior cover across agreed workstreams.
From
RM22,000/month
From 32 advisory hours per month
RM is the contracting currency. Monthly USD estimates use this formula: RM price ÷ 4.22, rounded to the nearest US$10. SGD figures are fixed indicative amounts for budgeting, not live conversions. Standard retainers begin with a three-month term and are invoiced monthly in advance. After that, either side may end the retainer with 30 days' written notice.
The baseline
The tier changes the amount of access and depth of involvement. The senior standard does not change.
Direct access to a named senior technical security consultant
Scheduled sessions plus an agreed email or Teams channel
Concise written decisions, priorities and next steps
One contracting entity and the systems agreed at onboarding
Confidential handling of technical and commercial context
Working terms
These are the practical rules we use to keep the relationship fair for both sides. The engagement letter will record the final scope.
Meetings, preparation, research, document review, written notes and between-session replies all use the monthly allocation. Time is recorded in 15-minute blocks.
We flag usage before the allocation is exhausted. Extra work starts only after written approval and is billed at RM900 per hour, estimated at US$210 per hour for budgeting, in one-hour blocks.
A package covers one client entity and the systems or workstreams agreed at onboarding. Client portfolios, unrelated products and white-label work need an Embedded scope.
Response targets mean an acknowledgement or a proposed next step, Monday to Friday from 9.00am to 6.00pm MYT, excluding Malaysian public holidays. They do not promise completion within that window or provide 24/7 emergency cover.
The retainer reserves senior capacity for that month. Unused hours expire at month end, and sessions moved with less than two business days' notice may still be counted.
We advise, review and challenge. Your team remains responsible for access, business decisions, implementation, change approval and testing in production.
Separately scoped work
The monthly retainer is for advice and review. The services below involve a defined piece of delivery work, so we agree the output, timing and fee before starting.
Subject to consultants' availability. A booking is confirmed only after the scope, schedule and fee are agreed in writing. USD estimates use the same RM ÷ 4.22 budgeting formula and are rounded to the nearest US$10.
For months when the included hours are likely to run out. We confirm the extra time in writing before doing the work.
RM900 / hourEst. US$210 / hour
We review one proposed design with the people building it, then record the decisions and actions. Includes preparation and a two-hour session.
RM2,800Est. US$660
A half-day session for one engineering team to work through current findings, code questions or design concerns with a consultant.
RM3,800Est. US$900
We take one existing pentest report, group the findings, agree priorities and help the team plan the fixes. Retesting is not included.
View a fictional sample reportFrom RM5,000Est. from US$1,180
A review of one agreed cloud environment or control area, followed by prioritised actions. This is not a full cloud audit.
From RM6,500Est. from US$1,540
A facilitated incident exercise for the people who would make the calls. You receive a decisions log and a list of readiness gaps to address.
From RM7,500Est. from US$1,780
We define practical security roles, checks and release gates for one delivery workflow. Tool implementation is quoted separately if needed.
From RM9,500Est. from US$2,250
What is not included
If a request falls into one of these areas, we will explain why and agree a separate scope before any work starts. No surprise assumptions on either side.
We do not watch logs, operate a SOC or MDR service, or respond to security alerts around the clock.
We can help decide what should be tested and review the results. Running a pentest or reviewing an entire codebase needs a separate proposal.
The monthly retainer is not an emergency hotline. Containment, investigation, evidence handling and recovery work must be arranged separately.
We can recommend or review a change. Your team or appointed provider remains responsible for implementing and approving it.
We can help interpret gaps and plan the work. Certification and formal audit opinions must come from the relevant independent body.
Writing a full policy suite, collecting audit evidence or implementing an ISMS is project work, not routine advisory support.
The retainer covers the contracting entity and agreed systems. It cannot be shared across unrelated products or used as pooled support for multiple clients.
No consultant can honestly guarantee that a breach, finding or audit issue will never occur. Our job is to help you reduce risk and make sound decisions.
The first call is for fit and scope: systems, owners, likely monthly demand and any work that should be quoted separately.
