How to Succeed as a Freelance Pentester

The talk is aimed at penetration testers considering leaving employment to work freelance. The speaker starts with the personal question of why someone wants to freelance. Setting your own hours and choosing clients comes with uneven workloads and the need to find all of your own work. He suggests listing the testing areas you can sell, such as web applications or external testing, and checking whether you can draw out a client's goals and data concerns.

The middle section covers setup costs and protections. He recommends forming a legal entity so personal assets are shielded from client claims, and carrying general liability, errors and omissions, and professional liability insurance. A business lawyer should review client agreements; he gives an example of keeping ownership of his own scripts after a contract review. An accountant who understands self-employment taxes and quarterly payments is also worth the fee. He estimates total startup costs at roughly five to ten thousand dollars.

For finding work, he compares subcontracting through consultancies, which is easier to start but pays less, with direct clients, which pays more but demands sales and proposal work. To set a rate, he works backward from a target salary and doubles the hourly figure to cover unbillable time. He credits networking and conference contacts as a strong source of leads, and says testimonials help a solo operator, who has no company brand to hide behind.