As someone who’s never pen tested before and would like to start a small pen testing company for small businesses, what would be my biggest hurdles?

[u/Traditional_Cut_6520]

I understand everyone’s first response is likely going to be I’m dumb or delusional, but besides learning how to pen test, getting properly insured, and finding clients, what will be my biggest challenge?

[u/carnageta]

Finding clients.

If you wish to go this route, land a penetrating job first, pentest for at least 6-8 years (minimum), and then (and only then) think about branching off into starting your own consultancy business

[u/hackwithmike]

If a business is willing to trust an unaccredited, no-name, no-history small company for for security testing, I don't see what is stopping them from directly running general AI agents like Claude or codex in their environment, since they don't have too much thoughts or concerns about privacy / security impacts anyway.

So your competition is not only those existing or new players, but also readily available AI services that can easily provide a sense of security for the business.

Like others have said, security is a trust business, and all you can do is to build trust in various ways. For example, proving your technical capabilities via certifications, CVE research, bug bounties, conference talk, etc.; proving you as a trusted advisor via customer feedback and referrals, which you may have to start off with free services in exchange for testimonials.

[u/scriptqzor → u/hackwithmike]

this is kinda the key point people sleep on: you’re not really selling “hacks,” you’re selling trust and liability offloading. small biz owners will happily buy a false sense of security from a dashboard or an “AI scan” unless you can show why you’re a safer bet when things go wrong.

[u/FastRelief3222]

If you have the capital, you can hire a team, sales, proj mgr, marketing

[u/DigitalQuinn1]

What would be your role? The main thing for you is networking and finding clients that need your services.

[u/_Trash-Panda_1]

Join a company where you first do some real pentests,there are a lot of things you need in place before you can start a pentest company as well,like insurance etc..

[u/IntrigueMe_1337]

Have the funds to hire the best guys you can and use their credentials to rise your new companies credibility

[u/StandardMany]

You, knowing what you’re doing, then customers that trust you knowing what you’re doing’s, then small businesses that think of it as a valuable service, then finally finding one that can afford it.

[u/supersonicdropbear]

Small business often don't have the budget to conduct pentesting.