Use portfolio frequency, not the last frightening incident
Start with closed incident records across comparable clients. Count events that required active investigation or control, hours by role, and whether the cause was within maintenance scope. Do not price from every alert or from one exceptional breach without labeling it as a stress case.
For 25 clients at 0.18 incidents per client-year and six hours per incident, expected labor is 27 hours annually. At a $120 loaded hourly rate, that is $3,240 before uncertainty. The formula is transparent enough to update as evidence improves.
Convert annual risk into a monthly reserve
Apply the example 30% uncertainty factor to $3,240, producing $4,212. Divide by 300 client-months to obtain $14.04 per client-month for the incident reserve. This is not the whole maintenance price; routine review, reporting, licensing, account management, and margin are separate lines.
Use weighted client classes if exposure differs materially. A high-volume commerce site with custom transports should not be subsidized invisibly by low-volume brochure sites. Keep the shared portfolio assumption only where service and incident patterns are genuinely comparable.
| Calculator line | Formula | Example |
|---|---|---|
| Expected incidents/year | clients × frequency | 25 × 0.18 = 4.5 |
| Expected hours/year | incidents × hours | 4.5 × 6 = 27 |
| Expected labor | hours × loaded rate | 27 × $120 = $3,240 |
| Risk-adjusted labor | expected labor × 1.30 | $4,212 |
| Reserve/client-month | risk-adjusted labor ÷ 300 | $14.04 |
| Maintenance price | reserve + routine work + license + overhead + margin | enter actual inputs |
Define what the reserve buys
Give each client a stated included allowance, such as first response, evidence capture, and a fixed number of incident hours per year. Define response window, supported paths, contacts, and deliverable. A pooled reserve finances expected work; it does not create unlimited labor for one account.
State separately billable triggers: unsupported custom integrations, provider migration, credential compromise, major data incident, out-of-hours staffing beyond the package, client-caused access delay, or remediation after root cause is established. Match exclusions to the actual contract and applicable obligations.
Allocate licenses without hiding labor
Add the appropriate Agency or Unlimited license allocation as its own cost line and verify current scope and permitted use. Do not divide a plan price by hostnames and call the result the maintenance cost; monitoring, evidence, decision-making, and support usually dominate delivery effort.
Likewise, do not promise that the license eliminates incidents. Controls can reduce exposure on supported paths, while retries, direct calls, provider failures, and operational mistakes still require diagnosis. Price the remaining responsibility explicitly.
Recalibrate every quarter
Compare assumed and actual incident frequency, hours, role mix, cause, client class, included consumption, billable extensions, and gross margin. Update prospect pricing prospectively and handle existing contracts according to their terms; do not retroactively reclassify included work because the reserve was too small.
The calculator is ready for commercial use when every input has a source, the allowance and exclusions are written, and a stress case shows the firm's capacity during correlated incidents. The Agency page supplies current plan scope; the calculator supplies the human operating cost that the plan price cannot represent.
Use the maintenance reserve calculator from “Add an incident reserve to AI maintenance pricing” on a real first installation. Download AI Cost Circuit Breaker for free, begin in Monitoring, and move to enforcement only after the expected signals and rollback are verified.