Demand for security consulting has never been stronger—data breaches, workplace violence, and regulatory compliance requirements keep business owners up at night. The barrier to entry is lower than you think, but success requires a strategic foundation and the right positioning. Here's how to build a legitimate, profitable security consulting practice from the ground up.
Define Your Specialty Within Security
Security consulting is broad. You could focus on physical security assessments, cybersecurity risk evaluation, compliance audits (SOC 2, ISO 27001, HIPAA), workplace violence prevention, loss prevention, or supply chain security. The more specific your niche, the easier you'll command premium rates—generalists compete on price; specialists own their market.
Start by answering: What's your existing expertise? A former loss prevention manager has natural credibility in retail. A background in IT operations opens doors to SMB cybersecurity work. If you're pivoting from security services (locksmiths, alarm installation), you already have client relationships to leverage. Pick one specialty and become known for it.
Get Your Credentials in Order
Clients expect credentials. Depending on your focus, invest in:
- ASIS CPP (Certified Protection Professional): The gold standard for physical security, requires 5 years of relevant experience or less with a degree. Budget $1,000–$1,500 for exam prep and fees.
- CISM (Certified Information Security Manager): Essential for cybersecurity consulting, though it requires 5 years of IT security experience.
- Certified Security Manager (CSM): Less rigorous than CPP, good for consultants with 3+ years of direct experience.
- Industry-specific certifications: HIPAA security officer, PCI DSS assessor, or compliance-focused credentials depending on your vertical.
Even while pursuing credentials, you can operate legally. Many established consultants started without formal certs—but getting one within your first 18 months builds trust faster.
Structure Your Business Entity
Register as an LLC or S-Corp (consult a CPA on which suits your income projection). You'll need:
- General liability insurance: $1,000–$2,500/year for a solo consultant
- Professional liability insurance: $2,000–$5,000/year (non-negotiable; clients require it)
- Cyber liability coverage: If you'll handle or discuss sensitive data, add $1,500–$3,000/year
These costs are business expenses and expected by enterprise clients. Skipping insurance is a massive red flag.
Price Your Services Strategically
Security consulting rates vary wildly by geography, specialty, and client size:
- Risk assessments: $2,500–$10,000 per project (smaller businesses on the lower end)
- Hourly consulting: $150–$350/hour depending on credentials and market
- Retainer arrangements: $2,000–$8,000/month for ongoing advisory to mid-market companies
Don't undercut yourself. A $5,000 assessment takes 20–40 hours of work, planning, and reporting. If you're charging $100/hour, you've left money on the table. Research competitors' rates in your region, then position yourself slightly above average if you have credentials.
Build Your Initial Client Base
Your first clients come from your network:
- Former colleagues in security, loss prevention, or risk management
- Business owners you already know (manufacturers, healthcare, retail)
- Professional associations (ASIS, chambers of commerce, industry groups)
Offer a discounted "launch rate" ($3,000 instead of $5,000) to secure 3–5 case studies in your first 6 months. These become your portfolio. Ask for testimonials and permission to list results (without naming the client if they prefer).
List your services on directories and business platforms where your ideal clients search. Mercoly helps security consultants get discovered, attract qualified leads, and sell both services and products—from risk assessment reports to security audit templates.
Document Your Process
Create a repeatable framework for assessments:
- Pre-engagement questionnaire
- On-site evaluation checklist
- Risk scoring methodology
- Written report template with findings and recommendations
- Follow-up proposal for implementation support
This speeds delivery, ensures consistency, and makes you look professional. It also creates upsell opportunities—assessments often lead to implementation contracts.
Frequently Asked Questions
Q: Do I need a background in security to start consulting? Not necessarily, but you need relevant professional experience in a related field (loss prevention, law enforcement, IT, facilities management). Clients expect at least 3–5 years of hands-on work before paying for your advice.
Q: How long before I can charge premium rates? With credentials and 2–3 strong case studies, you can move into the $5,000–$8,000 per-assessment range within 12–18 months. Retainer clients typically come after they've seen quality work.
Q: Should I specialize in physical security, cyber, or both? Start with one. Attempting to be a generalist consultant splits your credibility and marketing effort. Once you own one space (12+ months), you can expand to adjacent areas.
Start with one client, one process, and one service offering—then scale.