Meetcatcher

How to get clients as a cybersecurity consultant

In short

Small and mid-sized companies rarely buy security out of fear. They buy when someone asks them for proof: a large customer sends a supplier security questionnaire, an insurer asks about MFA and backups at renewal, or a product falls under the Cyber Resilience Act. Sell help with that exact request. Managed IT providers and insurance brokers send the best clients; threat-news posts mostly reach other security people.

Why small companies suddenly need a security consultant

Under NIS2, the EU rules for important sectors, covered organisations must manage the security of their suppliers. In practice, mid-sized software firms, logistics providers and agencies receive long security questionnaires from larger customers, often with a 30-day deadline and nobody to answer them. Cyber insurers ask similar questions at renewal, and since 11 September 2026 makers of connected products must report actively exploited vulnerabilities under the Cyber Resilience Act (CRA).

The five techniques below sell help with those requests: answering a supplier questionnaire in ten working days, preparing a company for its insurance renewal, a CRA reporting runbook for product makers, a 90-day security lead role before a first enterprise deal and an incident exercise for the management team. About 37% of questionnaire projects lead to ongoing work, because the next customer sends a similar form. Work only from documents the client gives you, and never test systems without written permission.

Trust decides who gets hired, and it is hard to build by email. Meetcatcher points you to firms that could use your expertise and offer something back, such as a software firm facing its first big customer audit, and lets you set up a short call with the founder or CTO. It is also a practical way to meet managed IT providers and insurance brokers who need a security partner they can recommend.

5 ways to get new clients

  1. 1

    Answer a NIS2 supplier questionnaire in ten working days

    When a large customer sends a 200-question security questionnaire, a 30-person supplier often has nobody to answer it. Offer a fixed package: interview the CTO, collect evidence, write honest answers and a short gap plan. Keep the answers as a reusable library, so the next questionnaire takes a day, not a month.
  2. 2

    Prepare companies for their cyber insurance renewal

    Insurers now ask about multi-factor authentication (MFA), backups and endpoint protection before they renew a policy. Offer a check 60 days before renewal: go through the insurer's form, fix what blocks a good answer and document the rest. Owners understand a renewal deadline far better than a risk score.
  3. 3

    Write a CRA reporting runbook for connected-product makers

    Since 11 September 2026, makers of products with digital elements must report actively exploited vulnerabilities, with an early warning within 24 hours. Small hardware and IoT firms often have no process. Deliver a runbook: who decides, what goes to ENISA's reporting platform, templates and one practice run, in about four days.
  4. 4

    Be the security lead for a SaaS before its first enterprise deal

    A SaaS start-up that signs its first enterprise customer suddenly faces security reviews, data processing terms and questions about ISO 27001. Offer a 90-day role at two days a week: policies, access reviews and answering the customer's security team. Many stay on for the certification project that follows.
  5. 5

    Run a two-hour ransomware exercise for the management team

    Most small companies have never practised the morning when every file is encrypted. Run a tabletop exercise, a scenario played out hour by hour with the owner, finance and IT. Leaders find the gaps themselves, which makes the follow-up project easy to approve. Business associations can host it for 6–8 firms at once.

Channels that work best

  • Managed IT providers without security staff

    Top channel    Clients ask them security questions every week, and they need a specialist to send them to.

  • Cyber insurance brokers

    Top channel    They watch renewals stall over MFA and backups and want clients who pass the form.

  • Supplier questionnaire deadlines

    Strong    A dated, urgent request that a small company can neither ignore nor answer alone.

  • Industry association workshops

    Supporting    Reach several owners at once, but turning interest into work needs a personal call.

  • Threat news and fear-based posts

    Limited    Owners tune them out, and other security people make up most of the audience.

Creative ways to win clients through partners

  • Managed IT providers (MSPs)

    An MSP runs the client's laptops and servers but often lacks staff to answer audits or write policies. Agree a clear split: the MSP fixes the technical gaps you find, while you handle questionnaires, policies and the management side, with a 10% referral fee in each direction. The client sees one team, and neither of you competes for the other's work.

  • Cyber insurance brokers

    Brokers lose time when a client cannot answer the insurer's security questions. Offer their clients a fixed readiness check 60 days before renewal, paid by the client directly. The broker gets a cleaner submission, and you meet owners at the exact moment they need help. Take no commission on policies, so your advice stays independent.

  • Law firms advising on data protection

    When a client signs a large contract with security clauses or suffers a breach, lawyers handle the legal side but need someone to explain the technical facts. Offer to be their technical expert for contract reviews and incident analysis. They bring you in under their engagement, which builds trust with the client faster than any outreach could.

Numbers to aim for

Targets for a small team. Adjust them to your size.
37%Questionnaire projects that lead to ongoing workIf lower, offer to keep the answer library up to date.
9 daysTime to answer a 200-question supplier reviewPast 15 days, customers start to doubt the supplier.
“Every call leaves a footprint. Even if they say no today, they’ll remember the name next time.”
Sales leader
Read: How many touchpoints does it take to book a B2B meeting?

Frequently asked questions

How much does a cybersecurity consultant charge a small company?

In Europe, independent consultants typically charge €85–160 an hour. Fixed projects are easier to sell: a supplier questionnaire package often costs €1,900–4,800 and a 90-day part-time security lead role €7,000–14,000, depending on company size.

Is NIS2 a reason for small companies to hire a consultant?

Often yes, even when they are not covered directly. Many small firms feel NIS2 through their customers, who must check the security of their suppliers. Each EU country wrote NIS2 into its own law, so check the national rules for scope and deadlines before you advise anyone.

Can I scan companies' websites for security problems and contact them?

No. Testing systems you do not own without written permission can be illegal, and even passive findings sent unasked feel like a threat. Start from documents a client shares with you, public company news or a partner's introduction, and sell help with a request the client already has.

How do cybersecurity consultants get their first clients?

Through people who already see the problem: IT providers, insurance brokers and lawyers. Expect owners to say no first and come back after an audit or incident; our look at what 100 cold calls bring shows how slowly trust builds. Keep in touch calmly, and plan for a longer sales cycle.

Other industries

See all
Webflow developersWin Webflow projects from design studios, hiring signals and sites hitting platform limits.IT support companiesSign managed IT contracts at the moments firms must change: moves, renewals, deadlines.AI automation agenciesWin automation work from job ads, PDF orders and AI workshops that end in a backlog.
MeetcatcherNEXT STEP

Meetcatcher finds B2B leads for you

Enter your website and we'll analyze it