One Platform for Every Client’s Security Program
Phishing simulation, continuous attack-surface monitoring, and board-ready compliance reports — across every client on your retainer, under your brand, on billing you can price into a fixed fee.
Built for the way vCISOs actually work
A virtual CISO carries the security program for ten, twenty, or more client organizations at once — on retainer, as an embedded ongoing advisor rather than a one-time assessor. That is a different shape of work than either an internal security team or a point-in-time pen-test firm. You need consolidated visibility across every client for your own quarterly reviews, you bill per deliverable so cost predictability is non-negotiable, and you have to present tooling ROI to each client’s board separately, through each client’s procurement.
HailBytes covers exactly this: multi-tenant isolation so each client’s data stays separate, white-label reports you present as your own deliverables, and per-vCPU/hour Marketplace billing that lets you fold SAT and ASM into a fixed retainer without usage surprises. Two products, one operating model, the whole client book.
Why vCISOs run HailBytes SAT and ASM
Multi-client management
SAT carries multiple client organizations on one instance you operate, with row-level isolation across campaigns, targets, results and reporting, plus per-client sending identities and hostnames. ASM is one instance per client — its operator roles are instance-wide rather than Project-scoped, and recurring scheduled scans across multiple client Projects on a single instance are not supported today, so the VM boundary is the client boundary there. Either way, one client’s data never lands in another’s report.
Board-ready outputs
White-label compliance PDF reports per framework — SOC 2, NIST CSF, PCI DSS, HIPAA, and more — that you can hand a client’s board or auditor directly. The evidence is generated per client, ready for each client’s quarterly review, so your reporting cycle scales with the retainer instead of becoming a manual document-assembly job.
Predictable billing
Per-vCPU/hour Marketplace billing means you can price SAT and ASM deliverables into your retainer without usage spikes. Cost tracks the instance you size, not seats or assets, so the number you quote a client at signing is the number you carry all year — the cost predictability a fixed-fee retainer depends on.
Phishing + recon as a package
Combined SAT and ASM give you a complete “security program in a box” you can deploy per client: awareness training and phishing simulation on one side, continuous external attack-surface monitoring on the other. The two deliverables most retainers are built around, from a single vendor relationship.
White-label branding
SAT supports white-label branding and ASM generates branded PDF reports — so every artifact a client sees can carry your firm’s identity, not a third-party vendor’s. You present these as your own deliverables, which is exactly what an embedded advisory relationship is supposed to look like.
Whose cloud account does each instance run in?
Both models work, and the choice is usually driven by the client’s data-sovereignty and billing preferences:
- Your account. You deploy every instance in your own AWS or Azure account, manage the Marketplace bill centrally, and recover the cost through retainer pricing. Each client’s data stays separated by its organization on your SAT instance, and by its own instance on ASM. Simplest to operate — one billing relationship, central upgrades.
- The client’s account. Each client subscribes through their own Marketplace account, so billing lands on their invoice and counts toward their AWS EDP / Azure MACC commit, and data residency is unambiguous. You manage the instance through access the client delegates to you.
The MSSP resources page covers the single-instance, HA, and auto-scaling topology options in more detail if you’re standing up a larger book.
What this costs across your client book
Clients share a SAT instance as separate organizations rather than each getting their own VM — separate campaigns, targets, results and reporting, per-client sending identities and hostnames, and no seat cap on any organization. Branding and SSO are instance-wide rather than per organization, so everything on that instance carries your firm’s brand; a client that needs its own brand, its own identity provider, or its own admin users needs its own instance. One 8 vCPU instance is $1,400/month in software fees ($16,800/year at list) plus roughly $280/month of cloud infrastructure in your own account — about $20,160/year all-in. Consolidated, that lands at roughly $1,100–$3,400 per client per year in software fees, plus about 20% on top for your own cloud bill. We do not publish a maximum organization count per instance — there is no measured basis for one, so size to your own send volume and target counts rather than to a density we told you:
| Shape | Software fees / year | Your cloud infra / year | All-in / year |
|---|---|---|---|
| SAT, one 8 vCPU instance for the book (list) | $16,800 | ~$3,360 | ~$20,160 |
| SAT, same instance on a 1-year commitment | $11,760 | ~$3,360 | ~$15,120 |
| SAT, dedicated 8 vCPU instance for one client (list) | $16,800 | ~$3,360 | ~$20,160 per client |
| ASM, one 8 vCPU instance per client (list) | $16,800 | ~$3,360 | ~$20,160 per client |
Software fees at list from the pricing page; cloud infrastructure at ~$35/vCPU/month for the whole stack (VM, PostgreSQL, Redis, storage), billed to your own account and varying by region and reserved-instance pricing. Two levers move the per-client number: a 1-year commitment paid annually upfront takes 30% off the software fee, and every additional client organization on the SAT instance divides the same fee further — but there is no published organizations-per-instance figure, because we have not measured one, so do not build a retainer on an assumed density before testing your own send volume. This is the platform cost; the retainer fee on top is yours to price. Two cases break the shared-instance economics and are worth pricing separately: a client whose MSA requires a dedicated VM and database, or that requires its own branding, its own identity provider, or self-service administration, is a separate 8 vCPU instance at ~$1,680/month all-in. And ASM is one instance per client, so adding ASM costs ~$1,680/month all-in per ASM client, not once across the book — plan on 8 vCPU, because a larger ASM instance does not scan faster without a configuration change to its scan worker’s CPU and memory limits. Full sizing guidance, including a vCISO-specific table, is on the pricing page.
Going deeper
vCISO practices use HailBytes in two distinct ways, and the right next step depends on yours:
- Running it as your own tooling for the clients you advise — the pricing page covers the per-client platform cost you fold into your retainer, and the PoC process page documents how to scope a combined SAT + ASM evaluation.
- Reselling the platform to clients under your own brand — the MSSP resources and partner resell pages cover the white-label resale mechanics, the annual commitment discount tiers (30% 1-year prepaid / 35% 2-year / 40% 3-year), and scan-time cost attribution per Project.
vCISO FAQ
Can a vCISO run both phishing simulation and attack surface management from one platform?
Yes. HailBytes SAT delivers phishing simulation and security awareness training; HailBytes ASM delivers continuous external attack-surface monitoring. Together they cover the two recurring deliverables most vCISO retainers are built around — awareness training and exposure management — and both run per client with isolated data and white-label reporting under your firm’s brand.
How do vCISOs price HailBytes into a fixed retainer?
Both products bill on AWS or Azure Marketplace per vCPU-hour rather than per seat, so cost tracks the instance you size, not headcount. A vCISO puts several client organizations on one SAT instance they operate, deploys ASM one instance per client, knows the monthly cost in advance, and prices SAT and ASM deliverables into the retainer without usage spikes blowing up the margin. The marketplace fee is software only — deployments are Bring-Your-Own-Cloud, so the VM and database sit on your own cloud bill.
Can vCISOs present HailBytes reports as their own deliverables?
Yes. SAT supports white-label branding and ASM generates branded PDF and compliance reports (SOC 2, NIST CSF, PCI DSS, HIPAA, and more). A vCISO can hand each client board-ready evidence under the vCISO firm’s own brand, separately per client, for each client’s quarterly review and procurement process. HailBytes’ own platform compliance posture is documented in the Trust Center.
Free Worksheet: vCISO Tooling & Retainer Pricing
Model per-client platform cost, choose a retainer structure, and protect your margin when tooling is part of the deal. Instant access.
Talk Through Your Client Book
Every vCISO practice is shaped differently — client count, frameworks in play, and how you package deliverables. A solutions engineer can map SAT and ASM to your retainer model before you stand up the first client instance.