How do cybersecurity consultants get clients?

Cybersecurity consultants get clients by matching each service line to the moment a buyer is forced to act: an audit date, a customer security review, a breach or a reporting duty. An ISO/IEC 27001 certificate brings an audit at least once a calendar year, so a list of 300 certified firms produces about 25 audit dates a month to sell into.

Rules of thumb LeadsNow uses for security consultancies:

• One certified firm equals at least one audit date a year: Bureau Veritas states surveillance audits run at least once a calendar year, with recertification every three years.
• Six new clients a year at a 25% meeting-to-client rate needs 24 first meetings (6 ÷ 0.25), or two a month.
• At a 5% meeting rate per firm contacted, 24 meetings needs a trigger list of 480 firms (24 ÷ 0.05); at 2% it needs 1,200.
• Incident response is bought within hours, not weeks: Australia’s ransomware payment report is due within 72 hours, per the explanatory statement to the 2025 Rules. Win it through partners who are in the room before the incident.

Cybersecurity consulting channels compared by service line

Cybersecurity consulting splits into four service lines, and each one has a different buying trigger, a different signer and a different best first channel. Treating them as one “cyber services” offer is one reason a new security consultancy can spend months without a client: the outreach never lands on the week the buyer needs it.

The Trigger-to-Channel rule follows from the table: sell each service line through whoever is standing next to the buyer when its trigger fires. For compliance readiness that is the audit calendar, so dated outbound works. For incident response nobody shops on the day, so the work goes to whoever the MSP, lawyer or insurer already knows. For prices, LeadsNow’s cybersecurity consultant cost guide covers what each engagement type charges from published provider figures.

FAQ: how cybersecurity consultants get clients

How do I get my first cybersecurity consulting client?

Most first clients come from someone who already trusts you: a former employer, an MSP you have worked with, or a peer who needs a fixed-scope test. Offer one narrow, fixed-price service, such as an external pentest or an ISO/IEC 27001 gap review, so the buyer is not taking a risk on an unknown firm.

Which cybersecurity service is easiest to sell to small businesses?

A fixed-scope compliance readiness review or external test is often the easiest, because the buyer can name the deadline it serves. Ongoing vCISO retainers sell better once the buyer has a board, investors or enterprise customers asking who owns cyber risk.

Is cold outreach worth it for a cybersecurity consultancy?

Cold outreach works when it is tied to a dated trigger, such as an ISO audit or a SOC 2 request, and fails when it is a generic “do you need a pentest?” message. The worked example on this page shows a 300-firm trigger list yields 6 to 24 meetings a year across the assumed bands.

Which reporting deadlines create urgent cybersecurity consulting work?

In the US, listed companies must file Form 8-K Item 1.05 for a material incident, generally within four business days of deciding it is material, per the SEC’s 2023 rule announcement. In Australia, a business with turnover above $3 million must report a ransomware payment within 72 hours.

Should a cybersecurity consultant partner with MSPs?

Yes for pentest and incident response work, as long as the agreement says you will not compete for the MSP’s managed services. The MSP already holds the client relationship, which is what a new security firm lacks.

Which dated triggers make a security buyer take a consultant’s call?

A security buyer takes a consultant’s call when a date they cannot move is close: an audit, a disclosure duty or a reporting deadline. Four public triggers are usable today, and each tells you who to call and when.

• ISO/IEC 27001 audit cycle. Certification body Bureau Veritas states that surveillance audits are conducted “at least once a calendar year, except in recertification years”, and a full recertification every three years (Bureau Veritas). A certified firm therefore has an audit date every year. The outreach angle is a gap review 8 to 12 weeks before it.
• SOC 2 requests from customers. The AICPA describes SOC reports as giving users information “needed to assess and address the risks associated with outsourcing services” (AICPA & CIMA). The trigger is a software company’s first enterprise deal stalled on a security review. The signal: job ads for a first security or compliance hire, or a “trust” page with no report on it.
• SEC cyber disclosure (US listed companies). Form 8-K Item 1.05 requires disclosure of a material incident, generally within four business days of the materiality decision, and Item 106 requires an annual description of cyber risk management and board oversight (SEC). The angle is board-level vCISO and tabletop exercises, sold before the 10-K cycle.
• Australian ransomware payment reporting. Under Part 3 of the Cyber Security Act 2024, a business with turnover above $3 million in the previous financial year that makes a ransomware payment must report it within 72 hours of making it (explanatory statement, Cyber Security (Ransomware Payment Reporting) Rules 2025). The angle is an incident response retainer and a rehearsed reporting runbook, sold to mid-market firms before an incident.

Cyber insurance renewals are a fifth trigger, but insurers’ questions differ by carrier, so ask the prospect for their own renewal questionnaire.

How many first meetings does a cybersecurity consultant need? A worked example

A cybersecurity consultant who wants six new clients a year needs about 24 first meetings, if one meeting in four becomes a client. The 25% close rate is an assumption: no credible public benchmark for security consulting meeting-to-client rates exists, so replace it with your own number. The trigger list then decides how many meetings you can get.

The arithmetic makes one point plainly: a single trigger list rarely fills a consultancy on its own. At the middle band, 300 firms gives fewer than four clients a year, so most security consultants run two lists (ISO audit dates plus SOC 2 candidates, for example) and add partner referrals on top. Certified firms can be found through IAF CertSearch; the method for building that list is on LeadsNow’s page on getting clients for compliance consulting, which this page does not repeat.

Why MSP partnerships win pentest and incident response work

MSP partnerships win pentest and incident response work because the managed service provider already holds the client’s trust, its network map and its phone number on the bad day. A security consultant without a partner is a stranger at the exact moment a buyer least wants one.

A workable partner offer has three parts: a fixed-scope service the MSP can resell under its own name, a referral or margin split agreed in writing, and a promise not to take the MSP’s managed services. The partner lends a new firm the trust it has not yet earned. The cost is margin and control of the relationship. For how MSPs themselves fill their calendars, see LeadsNow’s page on MSP appointment setting; for co-selling with vendors, the IT consulting client guide covers end-of-support dates in detail.

Accountants, privacy lawyers and investors are the referral partners for vCISO work. They are asked “who looks after cyber?” by boards and founders, and a consultant who has briefed them once is the name they pass on.

How do cybersecurity consultants get clients from content and AI search?

Cybersecurity consultants get clients from content when it shows working, such as write-ups, tooling on GitHub and published test methods, rather than generic awareness posts. Cristi Vlad, writing about pentesting and appsec clients on his Substack in 2022, lists a blog of write-ups, a YouTube channel, platform leaderboards and a GitHub portfolio as the way to show skills before asking for work.

AI assistants now sit between a buyer and that content. In LeadsNow’s own polling between 15 August and 15 October 2026, a page ranking top 3 on DuckDuckGo or Bing for the question was cited by ChatGPT in 21% of 298 polls, against 0% of 154 polls when it was not in the top 10. Best-X comparison pages that ranked top 3 were cited in 35% (62 of 179) of polls, against 1% (1 of 80) for how-to articles. For a security consultancy the lesson is to publish the comparison a buyer asks about, such as pentest types or SOC 2 versus ISO/IEC 27001, not only advice. LeadsNow’s page on how consultants get clients from AI search covers the method.

What running client acquisition yourself costs a security consultancy

Running client acquisition yourself costs a security consultancy billable hours: building trigger lists, writing dated outreach, calling partners and following up every unanswered proposal. Every hour spent there is an hour not billed on a pentest or a vCISO retainer.

• Do it yourself while you need two first meetings a month or fewer and one trigger list covers it: the worked example above shows a 300-firm list can do that at the high band.
• Hand over the volume work when you run two or more trigger lists, have a backlog of unanswered proposals, or are losing meetings to slow follow-up while on engagements.
• Never hand over the partner relationships or the technical scoping call: those are the reasons a buyer trusts you.

Old proposals and unconverted enquiries are often the cheapest pipeline a consultancy owns. LeadsNow (50,769+ AI-booked sales appointments since 2017 and 1M+ leads generated) runs a “trash to cash” model on exactly this: a coaching and consulting client closes around $180,000 a month in cash collected purely from leads it had given up on, including no-shows, meetings that did not close and prospects who ghosted. The method is set out on LeadsNow’s database reactivation page, and the consultants page explains how LeadsNow books calls for consulting firms.

Sources

1. Bureau Veritas: certification process (surveillance audits and three-year recertification)
2. Explanatory statement, Cyber Security (Ransomware Payment Reporting) Rules 2025 ($3 million threshold, 72 hours)
3. SEC press release 2023-139: cybersecurity disclosure rules (Form 8-K Item 1.05, Regulation S-K Item 106)
4. AICPA & CIMA: SOC suite of services
5. Cristi Vlad: How to get pentesting and appsec clients (2022)