Ransomware, phishing and data breaches threaten businesses of every size, and small and midsize companies rarely have security staff of their own. The Bureau of Labor Statistics projects employment of information security analysts to grow 29% from 2024 to 2034, one of the fastest rates of any occupation, with a median wage of $124,910 in May 2024.
Small cybersecurity businesses serve clients through assessments and consulting, managed security services billed monthly, and compliance help for regulations and contract requirements. Trust, clear scope and careful legal protections matter as much as technical skill.
The workforce
| Occupation | Jobs (2024) | Median pay (May 2024) | Projected growth, 2024 to 2034 |
|---|---|---|---|
| Information security analysts | n/a | $124,910 | +29% |
Source: U.S. Bureau of Labor Statistics, Occupational Outlook Handbook and Occupational Employment and Wage Statistics.
Business models compared
The figures below are illustrative months from our research, not industry averages. They show how revenue and costs typically fit together; your market, prices and costs will differ.
| Business model | Startup costs | Example monthly revenue | Costs | Profit before owner pay | Margin |
|---|---|---|---|---|---|
| Independent security consultant | Low: tools, certifications, insurance, website | $18,000 | $2,500 | $15,500 | 86% |
| Managed security provider (owner plus 3) | Moderate: security platforms, staff, 24/7 monitoring partner | $70,000 | $57,200 | $12,800 | 18% |
| Compliance and risk practice | Low to moderate: frameworks, templates, assessor training | $30,000 | $9,200 | $20,800 | 69% |
Fixed and variable costs
For projections, the most useful split is between variable costs, which rise and fall with sales (materials, supplies, hourly labor, fees), and fixed costs, which you pay every month regardless (rent, salaried staff, insurance, loan payments).
| Business model | Variable costs (% of revenue) | Fixed costs per month | What it means |
|---|---|---|---|
| Independent security consultant | 2.2% | $2,100 | Mostly fixed: needs steady volume to cover overhead |
| Managed security provider (owner plus 3) | 22.0% | $41,800 | Mostly fixed: needs steady volume to cover overhead |
| Compliance and risk practice | 17.0% | $4,100 | Mostly fixed: needs steady volume to cover overhead |
What the numbers say
Consultants keep high margins with low overhead, but income depends on billable hours.
Managed security providers build recurring revenue, with analyst salaries and platform costs as the main expenses.
Compliance practices ride regulatory demand, packaging assessments and documentation into repeatable services.
The three models in brief
Independent consultant. Assessments, policies, incident response planning and advisory work. See IT services data.
Managed security provider. Monitoring, endpoint protection, email security and response, billed monthly per user or device.
Compliance and risk practice. Helping clients meet requirements such as CMMC, the FTC Safeguards Rule, HIPAA security and customer questionnaires. See consulting data.
Cost structure: managed security provider (owner plus 3)
Each cost as a share of the example month’s revenue ($70,000):
| Cost | Monthly amount | Share of revenue | Type |
|---|---|---|---|
| Analyst salaries | $30,000 | 42.9% | Fixed |
| Security platform and monitoring costs | $14,000 | 20.0% | Variable |
| Payroll taxes and benefits | $5,000 | 7.1% | Fixed |
| Sales and marketing | $3,000 | 4.3% | Fixed |
| Insurance | $1,500 | 2.1% | Fixed |
| Office and software | $1,500 | 2.1% | Fixed |
| Payment fees | $1,400 | 2.0% | Variable |
| Training | $800 | 1.1% | Fixed |
| Profit before owner pay | $12,800 | 18% |
A first-year projection: managed security provider (owner plus 3)
New businesses rarely start at full speed. This projection assumes revenue ramps from 35% of the example month in month 1 to 100% by month 12, variable costs move with revenue, and fixed costs stay the same every month. It’s a planning illustration, not a forecast.
| Month | Revenue | Variable costs | Fixed costs | Profit | Cumulative |
|---|---|---|---|---|---|
| 1 | $24,500 | $5,390 | $41,800 | -$22,690 | -$22,690 |
| 2 | $31,500 | $6,930 | $41,800 | -$17,230 | -$39,920 |
| 3 | $38,500 | $8,470 | $41,800 | -$11,770 | -$51,690 |
| 4 | $43,400 | $9,548 | $41,800 | -$7,948 | -$59,638 |
| 5 | $49,000 | $10,780 | $41,800 | -$3,580 | -$63,218 |
| 6 | $53,200 | $11,704 | $41,800 | -$304 | -$63,522 |
| 7 | $57,400 | $12,628 | $41,800 | $2,972 | -$60,550 |
| 8 | $60,900 | $13,398 | $41,800 | $5,702 | -$54,848 |
| 9 | $63,700 | $14,014 | $41,800 | $7,886 | -$46,962 |
| 10 | $66,500 | $14,630 | $41,800 | $10,070 | -$36,892 |
| 11 | $68,600 | $15,092 | $41,800 | $11,708 | -$25,184 |
| 12 | $70,000 | $15,400 | $41,800 | $12,800 | -$12,384 |
Year one: revenue $627,200, profit before owner pay -$12,384. The first profitable month is month 7. Cumulative results bottom out at -$63,522, which is the minimum cash cushion this plan would need, before any startup costs.
Analyst salaries and platform costs start before monthly contracts build, so this managed security illustration turns profitable in month 7, with a cumulative low of about $63,500.
How cybersecurity firms earn
- Assessments and audits at project fees.
- Managed security at monthly rates per user or device.
- Penetration testing by scope.
- Compliance programs and documentation.
- Incident response retainers.
- Security awareness training.
Regulations driving demand
Many small businesses now face security requirements: the FTC Safeguards Rule for financial businesses such as tax preparers, auto dealers and lenders; HIPAA security for healthcare; CMMC for defense contractors; and customer security questionnaires. Explaining these in plain language opens doors.
Authorization is non-negotiable
Never test or access systems without written authorization defining scope, timing and permitted methods. Unauthorized testing can violate computer crime laws even with good intentions.
A startup checklist
- Earn recognized certifications.
- Carry cyber liability and tech E&O insurance.
- Use contracts with scope, liability limits and authorization language.
- Choose security platforms and partners for monitoring.
- Define a niche such as healthcare, finance or manufacturing.
Where the opportunities are
- Small healthcare and dental practices.
- Tax, accounting and financial firms under the Safeguards Rule.
- Defense supply chain CMMC preparation.
- Managed services for MSPs that lack security depth.
- Security awareness training.
Key terms
| Term | Meaning |
|---|---|
| MSSP | Managed security service provider |
| Penetration test | Authorized simulated attack to find weaknesses |
| CMMC | Cybersecurity certification for defense contractors |
| Safeguards Rule | FTC rule requiring security programs for certain financial businesses |
Partnering with IT providers
Many managed IT providers need security expertise. Partnerships or white-label services let you serve their clients without building a large sales operation.
Communicating risk
Small business owners respond to clear explanations of business impact, not jargon. Translate findings into priorities, costs and practical steps, and show progress over time so clients see the value of ongoing protection.
Key numbers to track
Track monthly recurring revenue, clients by service, analyst utilization, incidents handled, renewal rates and gross margin per client.
Common mistakes
- Testing without written authorization.
- Unlimited liability in contracts.
- Overpromising "complete security."
- Underpricing monitoring that requires 24/7 coverage.
- No niche.
Marketing a cybersecurity business
Educational workshops, LinkedIn content, partnerships with IT providers, accountants and attorneys, and case studies (with permission) build trust. See directory listings for professional services.
Incident response
Clients call when something goes wrong. Clear incident response plans, retainers and coordination with insurers and attorneys make you invaluable when it matters most.
Hiring analysts
Security talent is scarce. Offer training, certifications, interesting work and reasonable on-call schedules to recruit and keep analysts.
Tools and platforms
Endpoint detection, email security, identity protection, backup and monitoring platforms are the building blocks of managed security. Choose tools you can support well rather than many you can’t.
Insurance requirements
Cyber insurers increasingly require controls such as multi-factor authentication and backups. Helping clients meet insurer requirements is a strong selling point.
Backups and recovery
Reliable, tested backups are the last line of defense against ransomware. Helping clients set up offline or immutable backups, test restores and document recovery steps prevents disasters and builds long-term trust.
Pricing security
Price by users, devices or scope, with clear service levels. Avoid hourly-only pricing for ongoing protection.
Test these numbers with your own plan
Open this industry in our free Business Idea Reality Check to start from any model above, change prices, costs, startup budget and your own pay, and see your break-even month, the cash you’d need, three scenarios and how new businesses in this sector survive in your state.
- Start with the closest model and its cost structure.
- Replace every price and cost with local quotes.
- Estimate your ramp: how fast customers will realistically come in year one.
- Map cash month by month with the free Cash & Payroll Planner.
- Build the full plan in the free Business Planner.
About this data
Workforce figures come from the U.S. Bureau of Labor Statistics (Occupational Outlook Handbook and Occupational Employment and Wage Statistics, May 2024 wages and the 2024 to 2034 projections, unless noted). Market figures cite their sources above. Business model figures are illustrative months built from typical prices and costs to show how revenue, fixed costs and variable costs fit together; they are not industry averages or guarantees. We review these profiles when new government data is released, at least once a year, and the same figures power the Business Idea Reality Check.
Licensing and rules
There is no general license to provide cybersecurity services, but certifications such as CISSP, CISM, Security+ and specialized testing credentials are widely expected; penetration testing and other security testing require clear written authorization from the system owner, since unauthorized access can violate federal and state computer crime laws; some states regulate certain investigation work; defense contractors increasingly need Cybersecurity Maturity Model Certification (CMMC) assessments; contracts should define scope, liability limits and data handling; cyber liability and technology errors and omissions insurance are standard. Requirements change; confirm with your state and local agencies before you start.
Frequently asked questions
What do cybersecurity analysts earn?
BLS reported a median of $124,910 for information security analysts in May 2024.
Is cybersecurity growing?
Yes. BLS projects 29% growth from 2024 to 2034, one of the fastest rates of any occupation.
Do I need a license to offer cybersecurity services?
No general license, but certifications are expected and testing requires written authorization.
What is CMMC?
A cybersecurity certification program for defense contractors.
What is the FTC Safeguards Rule?
A rule requiring certain financial businesses to maintain information security programs.
What insurance do security firms need?
Cyber liability and technology errors and omissions insurance.
How do small security firms find clients?
Partnerships with IT providers, referrals from accountants and attorneys, and workshops on regulations clients face.
How can I test these numbers?
Open cybersecurity services in the Business Idea Reality Check and enter your own rates and costs.
Keep learning
Sources
Last reviewed November 1, 2026. Startup costs are estimates; check local prices, licensing and tax rules before you commit money.
