Risk analysis is what separates "watching" from a professional security service. Identifies threats, vulnerabilities, scenarios, and countermeasures and informs the plan and budget.
Good analysis saves money: it will throw out unnecessary shifts, strengthen weak points and give defensible reasons for the price.