-2

I am fluent with vulnerability research, and penetration testing, and red team tactics, and I only hold OSCP .

I was thinking about on creating a website similar to company services , and giving services, using marketing to get customers, and maybe with the help of 2 extra people with similar skills to get the job done. is it possible to do this without a physical company with only a great website as starting project?

|improve this question

closed as unclear what you're asking by scaaahu, Jenny D, gnat, IDrinkandIKnowThings, J. Chris Compton Jul 12 at 15:15

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

6

You're not going to like my answer, but... probably not.

See, the huge obstacle you're going to have to overcome isn't anything to do with technical skills - it has to do with marketing. Think about it from a medium-to-large company's perspective. You know data security is important - important enough to hire an outside consulting firm to pen-test your environment. Are they going to hire three random people with minor credentials that have a company with no/little prior history? Or are they going to hire a consultant firm with history in the field and a positive reputation?

Don't get me wrong - that's not an insurmountable obstacle. But... look at your post's title. Look at the first run-on sentence. Actually read your second paragraph's first sentence out loud. I'm not trying to be mean, but... you don't strike me as someone who excels at marketing and communication.

That's the thing I think you'll need to understand going in, if you decide to try to make a small info-sec business. The weakness and obstacle you'll have to overcome has nothing to do with the technical side: it'll be networking and being able to sell. Because it'll be a tough hill to climb.

|improve this answer
  • +1, but OP you definitely need a company AND professional indemnity insurance because it greatly helps to insulate you from risk. Suppose you do a Pen-Test and report for BigCo and 6 weeks later they have a massive breach, resulting in data theft and huuuge fines from regulatory authorities. Guess who they're going to pin that on...? – Justin Jul 12 at 9:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.