Your next client wants you to break their AI chatbot before attackers do — jailbreaks, prompt injection, data leakage through a RAG pipeline — and they will pay you $40,000 for three weeks of work. The engagement letter is signed. Half the fee arrives upfront. Then a second client asks for something completely different: continuous testing at $6,000 a month, cancelable anytime. One business, two totally different revenue shapes. If your books treat them the same way, your profit numbers will lie to you every single month.
AI red-teaming consultancies live at the intersection of two business models. Project engagements pay like traditional penetration tests — lumpy, high-value, defined scope. Continuous-testing retainers pay like SaaS — smaller, recurring, steadier. The bookkeeping has to handle both without mixing them up. Here is how to set it up right.
What You Are Actually Selling
Most AI red-teaming shops sell some mix of three offers. Each one books differently.
Point-in-time engagements. A scoped adversarial test of one system: a customer-support chatbot, a coding agent, an image generator. Industry pricing guides in 2026 put typical manual security engagements between $8,000 and $50,000, with complex multi-system exercises running past $100,000 toward $150,000. Scope multipliers include the number of models and agents in scope, tool-call and API surfaces, RAG corpus sensitivity, multimodal inputs, and whether a written report must map findings to frameworks like NIST AI 600-1, MITRE ATLAS, or the OWASP Top 10 for LLMs.
Continuous-testing retainers. Re-testing after every model or prompt change, monthly attack-library refreshes, runtime monitoring triage. AI consulting retainers broadly run $5,000 to $15,000 per month, with lighter advisory retainers starting around $1,500 to $5,000. For red-teaming, the common shape is a fixed monthly fee covering a defined number of test runs plus hourly overage for deep-dive investigations.
Hybrid platform-plus-services. A fixed setup and baseline assessment fee, then a smaller monthly subscription for automated scanning with human-led deep dives billed per finding or per sprint. This is the fastest-growing shape in AI services for 2026, because it gives the client cost certainty on the base and gives you upside on the variable work.
Book each offer as its own revenue line from day one. When a $40,000 engagement and a $6,000 retainer land in the same "consulting income" account, you cannot answer the only question that matters: which offer actually makes money?
Set Up a Chart of Accounts That Separates the Two Businesses
Create distinct income accounts:
- Red-team project revenue
- Retainer and subscription revenue
- Overage and hourly advisory revenue
- Pass-through reimbursables (cloud GPU time, licensed attack tooling billed at cost)
On the expense side, split delivery labor from overhead:
- Direct labor — employee testers assigned to engagements
- Subcontractor testers — 1099 specialists for overflow or niche skills
- Tooling and compute — automated scanning platforms, API costs for model calls during testing, GPU rental
- Report and QA labor — the senior reviewer who turns raw findings into a client-ready report
That last line surprises founders. Report writing and QA often consume 20 to 30 percent of total engagement hours. If you bury it in overhead, every project looks more profitable than it is, and you will underprice the next one.
Track reimbursables in a separate cost account and bill them separately — if you run your ledger in plain text, the documentation shows how to structure these accounts so they stay queryable as you add offers. Cloud compute burned during a large adversarial test run can reach thousands of dollars. Netting it against revenue hides both the true engagement margin and the client's true cost.
Recognize Revenue When You Earn It, Not When Cash Arrives
This is where red-teaming consultancies most often go wrong. The cash and the work rarely land in the same month.
Project engagements: recognize over time or at delivery. Under ASC 606, a fixed-fee red-team engagement is typically a single performance obligation — deliver the test and report — or a small set of obligations if scoping, testing, and retesting are separately defined in the contract. If the client receives value as you test (for example, critical findings reported immediately rather than held for the final report), recognize revenue proportionally as hours are delivered. If the contract delivers all value in the final report, recognize on delivery.
The practical bookkeeping: a 50 percent upfront deposit is not revenue. Book it as deferred revenue (a liability). Move it to revenue as the work is performed. A $40,000 engagement with $20,000 upfront and three weeks of testing should show roughly $13,000 per week in revenue, not $20,000 in week one and $20,000 at the end.
Retainers: recognize ratably. A $6,000 monthly continuous-testing retainer is $6,000 of revenue each month, even if the client barely uses you in a quiet month and hammers you the next. Overage hours are separate performance obligations — recognize them when performed. If a client prepays a quarter at a discount ($16,500 for three months instead of $18,000), book the full prepayment to deferred revenue and release $5,500 per month.
Milestone billing needs an unbilled-revenue account. Enterprise clients often pay net-30 or net-60 on milestones: 30 percent at kickoff, 40 percent at draft report, 30 percent at final. When you have performed work beyond what you have invoiced, book a contract asset (unbilled revenue). When you have invoiced beyond work performed, book deferred revenue. Reconcile both every month — stale balances in either account are the earliest warning that an engagement is off track.
If you use cash-basis books for taxes as a small shop, keep a parallel accrual schedule for management. Cash-basis profit on a month with two big deposits and little delivery will tell you to hire. The accrual schedule will tell you the truth.
Cost Every Engagement Like It Has to Stand Alone
Per-engagement job costing is the difference between a consultancy that scales and one that stalls at three people.
Build a simple engagement cost sheet for every project:
- Budgeted hours by role. Lead tester, supporting tester, report QA. Multiply by fully loaded cost (wages plus payroll taxes, benefits, and a share of downtime), not raw salary.
- Subcontractor cost. Specialists for multimodal testing or industry-specific compliance mapping often bill $150 to $300 per hour. Lock their rate in the budget before you quote the client.
- Tooling and compute. Estimate model API calls, scanning-platform seat time, and any GPU rental for the test window.
- Contingency. Adversarial testing expands — a chatbot that looked simple turns out to have six undocumented tool integrations. Add 10 to 15 percent.
Then track actuals weekly. The two KPIs that matter:
- Utilization: billable hours divided by total available hours per tester. Healthy boutique consultancies run 60 to 75 percent. Above 80 percent for months means burnout and sloppy reports. Below 50 percent means your pipeline or pricing is broken.
- Realization: revenue actually collected per billable hour versus your standard rate. If your standard rate is $275 per hour but fixed-fee overruns drag realization to $170, the problem is scoping, not sales.
For retainers, flip the lens: track cost-to-serve per retainer client per month. A $6,000 retainer that consistently consumes $5,000 of tester time at loaded cost plus $800 of compute is a 3 percent margin account wearing a recurring-revenue costume. Renegotiate scope, raise the fee, or cap included test runs with clear overage rates.
Tame the Cash Flow Rollercoaster
Project businesses die from timing, not from lack of profit. Three practices smooth it out.
Require deposits and tie milestones to calendar dates, not just deliverables. Thirty to fifty percent upfront is standard for boutique security work. For longer engagements, add a mid-point invoice triggered by a date ("50 percent due at week two regardless of draft status") so a slow client reviewer cannot stall your cash.
Build a 13-week cash forecast. List expected collections by client and week, not just invoices issued. Enterprise security budgets pay slowly — 45 to 60 days is normal. If two $40,000 finals both land in week nine, you need to see the gap in weeks three through eight now, while you can fill it with a small-scope sprint or a prepaid retainer quarter.
Keep a two-month operating reserve before hiring. Loaded payroll for testers does not pause when a client delays kickoff by a month. Fund the reserve out of the busy quarters. Park it in a separate high-yield business savings account so it does not read as spendable cash in your operating balance.
Watch days sales outstanding (DSO) monthly. If it creeps past 45 days, shorten payment terms for new contracts, add a late fee clause, and invoice milestones the day they trigger — not at month-end.
Taxes, Entity Choice, and Contractor Compliance
Most solo red-teamers start as sole proprietors or single-member LLCs on Schedule C, which is fine until profit consistently clears six figures. At that point, model an S corporation election: pay yourself a reasonable salary for a security consultant in your market, take the rest as distributions, and compare the payroll-tax savings against the added payroll and return costs. Revisit the math annually — it flips as headcount and profit change.
Four compliance items deserve calendar reminders:
- Quarterly estimated taxes. Lumpy project income makes the safe-harbor rule (pay 100 or 110 percent of last year's tax in four equal installments) your friend. It protects you from underpayment penalties in a year where Q3 revenue triples Q1.
- 1099-NEC filings. Every subcontractor tester paid $600 or more in the year gets one by January 31. Collect a W-9 before the first payment, not in January when the contractor is on another gig.
- State nexus. On-site testing, an employee in another state, or exceeding economic-nexus thresholds can create filing obligations where the client sits, not where you sit. Track work locations per engagement.
- Equipment deductions. GPU workstations, test servers, and Faraday-bagged device labs generally qualify for Section 179 expensing or bonus depreciation. Keep serial numbers and placed-in-service dates with the receipt — auditors ask for both.
If you are unsure whether your tester is a contractor or an employee, apply the control test honestly: you set their hours, require your tooling, and prohibit other clients, they look like an employee. Misclassification penalties dwarf any payroll-tax savings.
The Mistakes That Quietly Kill Margin
- Quoting from a rate card without scoping the attack surface. A "standard $25,000 red team" for a single chatbot becomes a loss when discovery reveals four agents, a RAG pipeline, and three API integrations. Scope in writing: models, tools, data sensitivity, retest rounds included, and what triggers a change order.
- Giving away the retest. Clients expect one retest of remediated findings. The second retest is billable. Put both sentences in the statement of work.
- Letting the report eat the margin. Cap internal QA rounds, use a findings template mapped to NIST AI 600-1 or OWASP LLM categories once, and reuse it. Every bespoke report format is unbilled labor.
- Running retainers without usage data. If you cannot show the client how many test runs, findings, and retests each month's fee bought, renewal negotiations become price negotiations. Automate the monthly summary from your testing logs.
- Mixing personal and business compute. That GPU rig that mines on weekends and tests client models on weekdays needs a business-use percentage log. Without it, the deduction does not survive scrutiny.
Keep Your Retainer Backlog Visible
Maintain a simple backlog schedule: contracted but undelivered project value plus remaining retainer months, updated monthly. It answers the questions revenue alone cannot — can you hire that second tester, can you survive a delayed enterprise deal, and is the business actually growing or just having a good cash month? Pair it with pipeline coverage: quoted proposals worth roughly three times your next quarter's capacity target keeps utilization in the healthy band without forcing discount quotes.
For deeper reading on structuring recurring versus one-time revenue, the professional-services revenue recognition guidance from RSM is a practical reference, and the Schellman methodology overview shows how established firms frame AI red-team delivery against standard frameworks.
Simplify Your Financial Management
As project deposits, milestone invoices, and monthly retainers start overlapping, keeping delivery profit separate from cash timing is what lets you price the next engagement with confidence. Beancount.io gives you plain-text accounting that is fully transparent and version-controlled, so every engagement's costs, deferred revenue releases, and retainer margins stay auditable as you grow. Get started for free and run your consultancy on books you can actually trust.
