Fee structures vary a lot between firms, and the sticker price alone rarely tells the full story — here's what's usually actually behind the number.
Project-based fees are a fixed cost for a defined scope, like an assessment or a penetration test — this is the most common structure for bounded, well-defined engagements. Retainer-based pricing gives you ongoing access to expertise for a recurring monthly fee, which suits businesses that need continuous availability rather than a single project.
Hourly billing is less common for clearly defined projects, but shows up more often for open-ended advisory work where the scope genuinely can't be pinned down in advance.
Premium pricing at large firms often scales with brand name recognition and layered account management structure, not strictly with the seniority of the specific person actually doing the work on your engagement.
That's not inherently wrong or dishonest — brand recognition and process maturity have real value in some contexts, particularly for very large, highly regulated organizations. But it's worth understanding clearly what you're actually paying for before assuming higher price automatically means higher quality of work.
A fair quote is scoped in writing, tied to specific, named deliverables, and clear about who's performing the work — not an open-ended number attached to vague language about "ongoing support" with no defined boundaries.
It should also be clear about what happens if scope changes mid-engagement, since that's a common point of friction and cost surprise if it isn't addressed upfront.
Differences often come down to who actually performs the work (senior specialist vs. junior team), how much account management overhead is baked in, and whether the quote includes things like retesting or follow-up support.
Not necessarily — retainers make sense when you need continuous availability, but if your actual need is a single, well-defined project, project-based pricing is often more cost-efficient and easier to evaluate.