A client requests a penetration test but is unsure of the full extent of their externally facing infrastructure, and they anticipate that new assets may be discovered during reconnaissance that could expand the effort. They want a contract structure that fairly accommodates this uncertainty while still allowing them to control overall spend. Which contract type should the penetration testing firm recommend during pre-engagement negotiations?