Cloud security reviews and audits, either by account/resource numbers which has a minimum of $500 for a single account with a reasonable number of resources or by the hour ($500) for which I have a 4 hour minimum. The small biz stuff is a breeze to audit and create reports on so I keep the lower rate available. I also do insider threat specific IR work which is typically done on retainer and starts at $10k but averages the $15-20k mark per incident. That work is rare but time sensitive. Hours spent can be as little as 5-6 for initial triage but I usually spend about 12 in a single stretch on average with a few hours of debrief for the client. That work is exhaustive and exhausting but is rarely boring.