can we start with one service and add others later?
yes, and most clients do. a build usually comes first, security follows before launch, and growth starts once there's something worth sending traffic to. nothing is bundled. you add a practice when you need it.
the three practices are quoted separately, each with its own scope and its own number. you can hire any one of them and never touch the other two. in practice most clients arrive with one need and add the next practice when the business creates it.
the usual order
- software comes first, because something has to exist before it can be secured or promoted: a site, a web app, an internal tool.
- security comes before launch. every build we ship gets attacked before we call it done. if we didn't build it, the security work still stands on its own: point us at what you have and we'll test it.
- growth starts once there's a page worth sending traffic to. ads pointed at a slow site with broken tracking burn the budget, so the landing pages and the tracking come first.
that order isn't a rule. plenty of clients only ever want the pentest, or only the ads, and that's fine. see do we have to use you for all three things?
why adding later is easy
because it's the same small team. when the people running your ads also built the site, the pixel fix ships that week instead of waiting in a developer queue. and when the people hosting it also tested it, nothing falls between two vendors. adding a practice takes one conversation and one new number. you don't go through onboarding again.
if you'd rather have all of it under one arrangement, the retainer covers whatever is technical this month, and you can start with that at any point too.