How to start a cybersecurity consultancy: the business paperwork

This guide is for a penetration tester or security engineer who wants to sell their own work instead of an employer's, and needs the company, the tax accounts and the insurance in place before the first invoice.

I started Inject, an Illinois LLC, and cofounded Brackish Security, a Maryland LLC. Both do security testing and are taxed as S corporations. None of this is tax or legal advice. It's just stuff I figured out along the way.

Hire an accountant before you file

Talk to an accountant (a CPA, or an enrolled agent who handles small businesses) before you form anything. The entity, the state and the timing of the S corp election all change your tax bill, and an accountant who knows your state can settle them in one meeting. Mistakes cost more to fix later: an S corp election filed late can need a private letter ruling from the IRS, which carries its own user fee (Form 2553 instructions).

Ask the accountant to run the S corp numbers with you once a year, even if the answer the first year is "not yet."

Pick the entity and the state

A sole proprietorship needs no state filing: you sell under your own name and report the profit on your personal return. An LLC (limited liability company) puts a company on the contract instead of your name, and keeps business debts and claims separate from your personal assets as long as you keep the money separate too.

By default the IRS treats a single-member LLC as part of its owner, and the owner pays self-employment tax on the net earnings "in the same manner as a sole proprietorship" (IRS single-member LLC page). An LLC with two or more owners is taxed as a partnership by default. Either kind can later elect to be taxed as an S corporation.

Form the company in the state where you live and work. A Delaware or Wyoming LLC still has to register as a foreign LLC in your home state if you do business there, so you pay two states' fees and file two annual reports.

With cofounders, write an operating agreement before the first invoice. It sets the ownership split, who can sign contracts and spend money, and what happens when someone leaves. A lawyer can draft one, or CorpNet sells a custom LLC operating agreement for $99 (CorpNet's pricing page).

File it yourself or through CorpNet

You can file the articles of organization on your Secretary of State's website and pay only the state fee. CorpNet prepares and files them for you and sends alerts when later filings come due. I use CorpNet for both companies' state filings. Its formation packages, as of November 2026:

State fees, shipping and a 3% convenience fee are added on top of every CorpNet price, and express and rush service are not offered in every state (CorpNet's pricing page).

If you want a registered agent anyway, Deluxe at $219 costs less than Basic plus a year of CorpNet's registered agent service ($99 plus $149). If you will be your own registered agent and get the EIN yourself, Basic or a direct state filing is enough.

Get the EIN from the IRS

The EIN (Employer Identification Number) is the company's federal tax ID. You need it for payroll, for the business bank account and for the W-9 a client asks for before paying your first invoice. The IRS issues it online in minutes, and its EIN page says "You never have to pay a fee for an EIN" (IRS). CorpNet's fee to file it online for you is $69. Apply directly unless the EIN comes bundled in a package you were buying for other reasons.

Registered agent

Every state requires a registered agent: a person or company with a physical address in the state, available during business hours, to receive lawsuits and official notices. You can be your own if you have an address in the state, but that address goes on the public business record. If you work from home, the public address is your home. CorpNet's registered agent service is $149 a year.

Skip the beneficial ownership report

FinCEN's final rule, effective August 14, 2026, says "U.S. companies are exempt from BOI reporting requirements and therefore, are no longer required to file BOI reports" (FinCEN). CorpNet's pricing page still lists a $199 beneficial ownership information (BOI) filing. An LLC formed in the US does not need it.

Elect S corp when the income justifies it

An S corporation must pay its owner "reasonable compensation" through payroll before taking other distributions (IRS on S corporation compensation). Payroll taxes apply to that salary, and the tax saving comes from the profit above it. The election also adds costs: a payroll service, quarterly payroll filings and a separate business return (Form 1120-S). At low income the costs can exceed the saving.

Both of my companies are S corps, and my advice is to elect once the income reaches the point where the saving covers those costs. Your accountant sets the salary and works out where that point is for your state.

The election is IRS Form 2553, which an LLC can file without first filing Form 8832. To take effect for a tax year it must be filed no later than 2 months and 15 days after that year begins, or at any time in the year before (Form 2553 instructions). The IRS instructions list no fee for the form itself. CorpNet's fee to file it is $99.

Payroll and contractors with Gusto

Once the S corp election takes effect you are an employee of your own company, so someone has to run payroll, withhold taxes and file the quarterly federal Form 941, the W-2 and the state withholding and unemployment returns. You can do that by hand. I run payroll for both companies on Gusto, which files those returns for a monthly fee. Gusto's plans, as of November 2026 (Gusto's pricing page):

All four plans pay US contractors, which is useful when you bring in a second tester for one engagement before hiring anyone. Gusto's pricing FAQ says US contractors are billed at the plan's per-person price only in the months you pay them.

Before the first payroll your company needs state withholding and unemployment insurance accounts. You can register on the state's own sites. Gusto sells state tax registration as an add-on priced by state, and CorpNet charges $199 per registration (CorpNet's pricing page). A company that signs up through the Gusto link above gets $100 after its first payroll, under the terms on Gusto's referral page.

Bookkeeping with Xero

Keep the books current from the first month. Your accountant needs them for the business return and for the S corp break-even number, and you need them to know whether the company can afford your salary. Open a business bank account, run every business payment through it, and reconcile it every week or two while the transactions are fresh. Books left for a year turn into a pile of unlabeled transactions before the tax deadline, and you pay your accountant by the hour to sort them out.

A spreadsheet is free and works with one or two clients, but it has no bank feed, so it falls behind the fastest. I use Xero for both companies and find it cost effective for a consultancy this size. Its US plans, as of November 2026 (Xero's pricing page):

The first-three-months prices are Xero's 80% discount for new US customers, which cannot be combined with other offers. The landing page behind the Xero link above advertises 90% off for six months instead, but Xero does not publish terms for that offer on the page, so check the price at checkout.

Xero also sells payroll powered by Gusto as an add-on, at $36 a month plus $6 per employee or contractor. That is less than Gusto's own Simple plan, and Xero's page does not say which Gusto features the add-on includes, so compare the two before you pick one.

Annual reports

States charge an annual fee to keep the company in good standing, and the amounts and dates differ. Maryland's 2026 Form 1 lists $300 for an LLC, due April 15, filed together with the business personal property return (Maryland SDAT Form 1). Your own Secretary of State's fee page has the figure and due date for your state.

A calendar reminder and the state's own portal cost nothing. CorpNet files annual reports for $99 plus the state fee, and its Basic package includes compliance alerts. A company that stops filing can lose its good standing, and some contracts ask for a certificate of good standing before signing.

Insurance clients will ask for

Clients set the minimum, usually in the master services agreement or the procurement terms. Public universities publish theirs, for example:

Sources: Sacramento State's IT insurance requirements and the University of Maryland insurance addendum.

For a new testing firm, start with technology errors and omissions (E&O) insurance that includes cyber liability, plus general liability, at $1,000,000 to $2,000,000 per claim. In my experience that coverage costs about $2,000 to $4,000 a year for a small testing firm. Raise the limits when a contract you want asks for more. Tell the broker you perform penetration testing and social engineering, and get written confirmation that the policy covers them. Expect clients to ask for a certificate of insurance and to be named as an additional insured, as the University of Maryland addendum requires. Gusto sells professional liability and workers' compensation policies through its insurance partner NEXT. An independent broker can quote several carriers at once.

Contracts before the first test

Verbal permission is hard to prove after a test takes something down. Before any engagement, have these signed:

• A master services agreement (MSA) with the liability cap, payment terms and confidentiality.
• A statement of work (SOW) for each engagement, with the scope, dates and price.
• Rules of engagement (ROE), the signed authorization to test, naming the IP ranges, domains, applications and people in scope, the testing windows, and an emergency contact on the client's side.

For cloud and hosted targets, the ROE must be signed by someone who controls the asset, and the provider's own testing policy still applies. A client cannot authorize a test of its hosting provider's infrastructure. Pay a lawyer to review the MSA template once and reuse it for every client.

Finding the first client

Start with your network: former employers and colleagues, and people who have read your reports or seen you speak. Tell them you are taking work, what kind and when you start.

Published research gives a prospect something to judge you by, whether that is a write-up of a CVE you found or a talk at a local security meetup. Paid advertising, such as search or LinkedIn ads, costs money before it brings work, so start with a small budget and record which channel produced each lead.

Public RFPs (requests for proposal) are another source. Federal opportunities are on SAM.gov, where registration and the Unique Entity ID are free. States run their own portals, such as eMaryland Marketplace Advantage and Illinois BidBuy, and both are free for vendors. In my experience with both companies, RFPs often ask for client references and past performance on similar work, so they are easier to win after a few private engagements.

Episode 196 of the Critical Thinking bug bounty podcast, "Local AI: The Future of Pentesting & Bug Bounty?" (October 15, 2026), tells bug bounty hunters to start pentesting companies now, before AI pushes prices down. Joseph Thacker says "if you're considering it, you should just do it," and that starting a company "is like a week of work": get a website, get an LLC. Brandyn Murtagh mentions that some clients require millions of dollars in insurance, but nobody in the episode covers your own E&O policy, an accountant, rules of engagement or bookkeeping. An earlier episode, "Starting a Pentesting Company on Top of Bug Bounty" (December 25, 2025), is more careful, and Brandyn tells listeners to pay for business and tax advice. It still never mentions insurance or authorization to test, and Joseph suggests that in many states you can skip registering a company and put your Social Security number on every client form.

I think they made starting a pentesting company sound much easier than it is. If a test takes down a client's production system and there is no E&O policy, the claim is paid by the company, or by you personally if you never formed one.

Brandyn says that it "really comes back to how you get your clients," but neither episode gets into how hard clients are to find and keep. In episode 196 Joseph says he has little inbound work, has done only a couple of pentests this year and recently hired a salesperson to find more, and still recommends starting now. In my experience, finding clients and keeping them is the difficult part of running a consultancy.