If a protocol opts to do a private audit contest, then the coverage price will be 2.5% instead of 2.0%. This is because Sherlock believes public audit contests are the #1 way to secure a codebase, but a private audit contest can go a long way as well.
Sherlock usually requires a month or so of upfront payment before coverage can be activated. From there, it's up to the protocol team in terms of paying bi-weekly, monthly etc. All Sherlock monitors is that the balance of payment does not reach zero. If it reaches zero (technically if it reaches 500 USDC) a protocol will be auto-removed from coverage by an arb bot.