You don't need a decade of IT experience to start a penetration testing business—you need certifications, a systematic approach, and the right market positioning. Most successful pen testers today started with foundational security knowledge and built credibility through recognized credentials. This guide walks you through the realistic path from zero to revenue-generating penetration testing services.
Start with the Right Certifications
The barrier to entry is certification, not years on the job. The industry recognizes three primary credentials:
CEH (Certified Ethical Hacker) costs around $1,000–$1,200 for the exam plus study materials, requires 2–5 hours of study weekly for 3–4 months, and opens doors with mid-market companies. OSCP (Offensive Security Certified Professional) runs $999 for the exam plus $800–$1,200 for the lab time, demands 40–60 hours of intensive hands-on work, and carries significant weight with enterprise clients. CompTIA Security+ is the cheapest entry point at $370 but typically works better as a prerequisite than as a standalone penetration testing credential.
Most service owners combine CEH as their first cert with OSCP within 12–18 months to command higher rates ($150–$250/hour for CEH-only, $200–$400/hour with OSCP experience).
Build Your Technical Foundation Without Waiting
You don't need the cert before you start learning. Set up a home lab using free tools and virtual machines:
- Download Kali Linux, VirtualBox, and OWASP WebGoat
- Practice on HackTheBox and TryHackMe ($14–$20/month for structured labs)
- Learn network fundamentals, basic Python scripting, and SQL injection techniques
- Spend 30–45 minutes daily on hands-on hacking exercises
This 2–3 month foundation costs under $100 and gives you tangible skills to discuss with your first certification instructor or mentor. Real clients ask about your process, not your years in IT.
Define Your Service Scope and Pricing Model
Penetration testing isn't one service—it's several, each with different costs:
| Service | Typical Duration | Price Range | Best For | |---------|-----------------|------------|----------| | Web application pentest | 40–80 hours | $5,000–$15,000 | SaaS companies, e-commerce | | Network pentest | 60–120 hours | $8,000–$25,000 | Mid-market enterprises | | Social engineering test | 20–40 hours | $3,000–$8,000 | All sizes, high ROI for clients | | Vulnerability assessment | 20–40 hours | $2,500–$7,000 | Small business entry point |
Starting out, vulnerability assessments and social engineering tests are your quickest wins. They require less time than full penetration tests, appeal to budget-conscious SMBs, and you can typically complete them in 2–3 weeks. A $4,000 social engineering engagement done efficiently is better than chasing $20,000 full pentest projects you're not yet equipped to deliver.
Land Your First Clients
Your initial clients come from:
Local B2B networks. Join chambers of commerce and IT security meetups. Mention you do vulnerability assessments (not "I'm starting a pentest firm"). $3,000–$5,000 assessments for 5–10 local SMBs get you case studies and testimonials.
Referral partnerships. Connect with managed IT service providers, business consultants, and insurance brokers who need pentest subcontractors. They have the clients; you have the skills. Offer 15–20% partner margin.
Vertical focus. Don't try to sell to everyone. Target healthcare (HIPAA compliance), financial services (regulatory requirements), or e-commerce. Compliance-driven verticals pay faster and expect regular testing.
Industry directories. Listing on platforms like Mercoly helps qualified leads find your services, enables you to showcase your certifications and specific service packages, and positions you alongside established competitors without requiring a massive marketing budget.
Manage Risk and Liability
Day one: get cyber liability insurance ($1,200–$2,500/year for a startup). Require signed scope documents and rules of engagement for every engagement. Document everything—your methodology, findings, and client sign-offs—to protect yourself legally.
Build Recurring Revenue
One-time pentest projects create income gaps. Create a retainer model: offer quarterly vulnerability assessments or monthly social engineering simulations for $1,500–$4,000/month. Five retainer clients = $7,500–$20,000 monthly recurring revenue with predictable workload.
Frequently Asked Questions
Q: Can I start a penetration testing business with just CompTIA Security+? Technically yes, but you'll struggle to win contracts above $2,000. Most clients expect CEH or OSCP; Security+ is better paired with another credential or 2+ years of hands-on experience in a security operations role.
Q: How long until I'm profitable? If you invest 3 months in certification and lab work, land your first client by month 5, and close 2–3 assessments monthly at $4,000 each, you'll hit profitability (after expenses) by month 8–10. Initial timeline is 6–12 months, not 3–6.
Q: What's the difference between a pentest and a vulnerability assessment? A vulnerability assessment identifies weaknesses (passive scanning); a penetration test exploits them to prove real-world impact (active attack simulation). Clients often start with assessments, upgrade to full pentests after seeing results.
List your penetration testing services on Mercoly today to attract qualified leads actively seeking your expertise.