One Platform for Every Client’s Security Program
Phishing simulation, continuous attack-surface monitoring, and board-ready compliance reports, across every client on your retainer, under your brand, on billing you can price into a fixed fee.
Built for the way vCISOs actually work
A virtual CISO carries the security program for ten, twenty, or more client organizations at once, on retainer, as an embedded ongoing advisor rather than a one-time assessor. That is a different shape of work than either an internal security team or a point-in-time pen-test firm. You need consolidated visibility across every client for your own quarterly reviews, you bill per deliverable so cost predictability is non-negotiable, and you have to present tooling ROI to each client’s board separately, through each client’s procurement.
HailBytes covers exactly this: multi-tenant isolation so each client’s data stays separate, white-label reports you present as your own deliverables, and per-vCPU/hour Marketplace billing that lets you fold SAT and ASM into a fixed retainer without usage surprises. Two products, one operating model, the whole client book.
Why vCISOs run HailBytes SAT and ASM
Multi-client management
SAT carries multiple client organizations on one instance you operate, with row-level isolation across campaigns, targets, results and reporting, plus per-client sending identities and hostnames. ASM carries client Projects on one instance you operate, each with its own targets, quotas, findings and recurring scheduled scans, scoped at the middleware and API layers. What stays instance-wide is the operator roles, the branding, and the billing screens, which are hidden from the sidebar but not access-gated: so a client that logs in, or that needs its own brand, takes its own instance and the VM boundary becomes the client boundary there. Either way, one client’s data never lands in another’s report.
Board-ready outputs
White-label compliance PDF reports per framework (SOC 2, NIST CSF, PCI DSS, HIPAA, and more) that you can hand a client’s board or auditor directly. The evidence is generated per client, ready for each client’s quarterly review, so your reporting cycle scales with the retainer instead of becoming a manual document-assembly job.
Predictable billing
Per-vCPU/hour Marketplace billing means you can price SAT and ASM deliverables into your retainer without usage spikes. Cost tracks the instance you size, not seats or assets, so the number you quote a client at signing is the number you carry all year: the cost predictability a fixed-fee retainer depends on.
Phishing + recon as a package
Combined SAT and ASM give you a complete “security program in a box” you can deploy per client: awareness training and phishing simulation on one side, continuous external attack-surface monitoring on the other. The two deliverables most retainers are built around, from a single vendor relationship.
White-label branding
SAT supports white-label branding and ASM generates branded PDF reports, so every artifact a client sees can carry your firm’s identity, not a third-party vendor’s. You present these as your own deliverables, which is exactly what an embedded advisory relationship is supposed to look like.
Whose cloud account does each instance run in?
Both models work, and the choice is usually driven by the client’s data-sovereignty and billing preferences:
- Your account. You deploy every instance in your own AWS or Azure account, manage the Marketplace bill centrally, and recover the cost through retainer pricing. Each client’s data stays separated by its organization on your SAT instance, and by its own instance on ASM. Simplest to operate, one billing relationship, central upgrades.
- The client’s account. Each client subscribes through their own Marketplace account, so billing lands on their invoice and counts toward their AWS EDP / Azure MACC commit, and data residency is unambiguous. You manage the instance through access the client delegates to you.
The MSSP resources page covers the single-instance, HA, and auto-scaling topology options in more detail if you’re standing up a larger book.
What this costs across your client book
Clients share one SAT instance as separate organizations rather than each getting their own VM. Every organization keeps its own campaigns, targets, results and reporting, its own sending identity and hostname, and carries no seat cap.
Branding and SSO are instance-wide rather than per organization, so everything on that instance carries your firm’s brand. A client that needs its own brand, its own identity provider, or its own admin users needs its own instance.
We have not measured one, so we do not publish one. Size to your own send volume and target counts rather than to a density we told you.
One 8 vCPU instance is $1,400/month in software fees ($16,800/year at list) plus roughly $280/month of cloud infrastructure in your own account: about $20,160/year all-in. Consolidated across a book, that lands at roughly $1,100–$3,400 per client per year in software fees, plus about 20% on top for your own cloud bill.
| Shape | Software fees / year | Your cloud infra / year | All-in / year |
|---|---|---|---|
| SAT, one 8 vCPU instance for the book (list) | $16,800 | ~$3,360 | ~$20,160 |
| SAT, same instance on a 1-year commitment | $11,760 | ~$3,360 | ~$15,120 |
| SAT, dedicated 8 vCPU instance for one client (list) | $16,800 | ~$3,360 | ~$20,160 per client |
| ASM, one 8 vCPU instance per client (list) | $16,800 | ~$3,360 | ~$20,160 per client |
Software fees at list from the pricing page. Cloud infrastructure at ~$35/vCPU/month for the whole stack (VM, PostgreSQL, Redis, storage), billed to your own account and varying by region and reserved-instance pricing.
Two levers move the per-client number
- A 1-year commitment paid annually upfront takes 30% off the software fee.
- Each additional client organization on the SAT instance divides that same fee further.
This is the platform cost. The retainer fee on top is yours to price.
- A client whose MSA requires a dedicated VM and database, or that requires its own branding, its own identity provider, or self-service administration, is a separate 8 vCPU instance at ~$1,680/month all-in.
- ASM adds a client Project on an instance you operate, or a dedicated ~$1,680/month all-in instance for a client that logs in or wants its own brand. Plan on 8 vCPU for a dedicated one: a larger ASM instance does scan proportionally faster, because the scan worker sizes its CPU and memory limits from the host.
Do not build a retainer on an assumed organization density before testing your own send volume. Full sizing guidance, including a vCISO-specific table, is on the pricing page.
Going deeper
vCISO practices use HailBytes in two distinct ways, and the right next step depends on yours:
- Running it as your own tooling for the clients you advise: the pricing page covers the per-client platform cost you fold into your retainer, and the PoC process page documents how to scope a combined SAT + ASM evaluation.
- Reselling the platform to clients under your own brand: the MSSP resources and partner resell pages cover the white-label resale mechanics, the annual commitment discount tiers (30% 1-year prepaid / 35% 2-year / 40% 3-year), and scan-time cost attribution per Project.
vCISO FAQ
Can a vCISO run both phishing simulation and attack surface management from one platform?
Yes. HailBytes SAT delivers phishing simulation and security awareness training; HailBytes ASM delivers continuous external attack-surface monitoring. Together they cover the two recurring deliverables most vCISO retainers are built around, awareness training and exposure management, and both run per client with isolated data and white-label reporting under your firm’s brand.
How do vCISOs price HailBytes into a fixed retainer?
Both products bill on AWS or Azure Marketplace per vCPU-hour rather than per seat, so cost tracks the instance you size, not headcount. A vCISO puts several client organizations on one SAT instance they operate, runs client Projects on an ASM instance they operate and gives a client its own ASM instance once it logs in, knows the monthly cost in advance, and prices SAT and ASM deliverables into the retainer without usage spikes blowing up the margin. The marketplace fee is software only: deployments are Bring-Your-Own-Cloud, so the VM and database sit on your own cloud bill.
Can vCISOs present HailBytes reports as their own deliverables?
Yes. SAT supports white-label branding and ASM generates branded PDF and compliance reports (SOC 2, NIST CSF, PCI DSS, HIPAA, and more). A vCISO can hand each client board-ready evidence under the vCISO firm’s own brand, separately per client, for each client’s quarterly review and procurement process. HailBytes’ own platform compliance posture is documented in the Trust Center.
Free Worksheet: vCISO Tooling & Retainer Pricing
Model per-client platform cost, choose a retainer structure, and protect your margin when tooling is part of the deal. Instant access.
Talk Through Your Client Book
Every vCISO practice is shaped differently: client count, frameworks in play, and how you package deliverables. A solutions engineer can map SAT and ASM to your retainer model before you stand up the first client instance.