Security questionnaires, policies and authorized phishing-awareness programs for SMBs
Rank #114 · Tier B · Priority score 52/100 · Category: Services & freelancing
Answer vendor security questionnaires (SIG/CAIQ-style), draft security policies and run authorized phishing simulations and awareness training for small companies.
Scores
| Metric | Value |
|---|---|
| Payment probability (6 months) | 3/10 |
| Automation after setup | 6/10 |
| Setup effort (1 = trivial) | 5/10 |
| Ongoing effort (1 = none) | 5/10 |
| Income potential | 7/10 |
| AI leverage | 7/10 |
| Legal in reference countries | 100% |
| Platform pays out in reference countries | 92% |
| Capital required | $0 |
| Time to first dollar | 21–120 d |
| Typical monthly income (low / median / high) | $0 / $400 / $8,000 |
Realistic expectations
Most people who try this earn around $0–$400 per month in the first year; the high figure of $8,000 is a ceiling for a focused solo operator, not a typical outcome. The chance of receiving at least one real payout within six months is rated 3/10. Expect the first payment after 21–120 d.
How it works
SMBs selling to larger firms face long security questionnaires and need written policies. An LLM drafts answers from the client's verified control inventory. You also run phishing-awareness simulations with Gophish (free, open-source) or a commercial platform, only under signed authorization for the client's own staff and domains. Packages renew yearly.
Platforms: Upwork, direct, Gophish (free open-source phishing-simulation framework), commercial phishing-simulation platforms (partner programs for MSPs/consultants, e.g. KnowBe4)
Resources & business plan
What you need to start
| Resource | Amount |
|---|---|
| Time to launch | 40 hours |
| One-time cash | $0 |
| Recurring fixed cost | $20 / month |
| Tools | Gophish (free, open-source); policy templates (free/open frameworks); LLM plan ( |
| Skills | security fundamentals (ISO 27001/SOC 2 concepts); mapping controls to questionnaire answers truthfully; running authorized simulations with signed scope |
| Equipment | laptop; reliable internet |
| Accounts | Upwork freelancer account + ID verification (proposals cost Connects, ~$0.15 each); Wise Business or Stripe account for invoicing (KYC); LinkedIn profile for outreach |
How the money is made (unit economics)
| Metric | Value |
|---|---|
| Unit | per questionnaire or policy pack |
| Typical price per unit (low / median / high) | $300 / $1,000 / $4,000 |
| Direct cost per unit | $0 |
| Platform fee | 5% |
| Gross margin (median case) | 95% |
| Human hours per unit after automation | 10 |
Estimate: consultants charge ~$75-$200/h; a questionnaire or policy pack takes 5-20 h; fee ~5% blended Upwork/direct. Fiverr (20%) and Upwork (variable 0-15% since 2025) fee figures are estimated: their official fee pages were bot-blocked when checked in Nov 2026.
Break-even
| Metric | Value |
|---|---|
| Monthly fixed cost | $20 |
| Units per month to break even | 1 |
| Typical months to break even | 5 |
| Months to recover startup cash | 0 |
Fixed cost = recurringMonthlyUsd only; startup cash is not amortised. Months include ramp-up to the first order.
Market conditions (Nov 2026)
| Factor | Assessment |
|---|---|
| Demand trend | growing |
| Competition | medium |
| Effect of AI | headwind |
| Price pressure | falling |
| Chance of real net profit within 12 months (≥ $100/month where the plan can pay that much) | 18% |
| Typical net profit at month 12 (low / median / high) | $0 / $0 / $6,000 |
Questionnaire volume keeps growing, but trust-center and compliance-automation platforms now auto-answer questionnaires with AI, compressing the freelance niche. Buyers prefer credentialed consultants (CISSP/ISO lead auditor), so newcomers find it hard to close. Liability for wrong answers is a real failure mode; work only from verified client evidence.
Pricing strategy
Start with a fixed-price questionnaire completion and policy starter pack, then sell an annual package with policy updates and quarterly awareness simulations.
Path to profit
- Month 0: policy template library and Gophish lab (cost $0)
- Month 1-3: outreach to SaaS startups and MSPs, expected $0-$300
- Month 3-6: first 1-2 clients via MSP referrals
- Month 6-12: 2-4 annual packages for those with credentials
Business-plan sources:
- https://getgophish.com/
- https://www.knowbe4.com/partners
- https://investors.upwork.com/static-files/468fcdc3-31a4-4432-9d1e-f8b50122dd65
Payout path
- Methods: Stripe invoice -> bank, Wise, Payoneer, PayPal -> bank
- Minimum payout: none (direct invoices)
- Frequency: per milestone or monthly retainer
- Typical delay: 14 days
- Notes: Net-7 to net-30 invoices; take 30-50% deposits. Stripe is not offered in many reference countries (stripe.com/global, Nov 2026: absent in e.g. the Philippines, Colombia, Argentina, Ukraine, Georgia, Armenia, Sri Lanka, Tunisia, Ecuador, Serbia; Nigeria, Kenya, Ghana and South Africa only via its extended network); Payoneer covers 190+ countries and territories.
Full cycle (setup → earn → bank account)
- Build answer library and policy pack
- Win first SMB via Upwork/MSPs
- Deliver questionnaire + policies
- Add quarterly simulations
- Invoice to bank
What can be automated
- LLM answer drafting from control inventory + answer library
- policy templates mapped to ISO 27001/SOC 2 controls
- scheduled simulation campaigns and reports
Unavoidable manual steps
- control interviews with client
- authorization paperwork
- evidence review
Legality & compliance
Legal with written authorization; unauthorized phishing/testing is a crime nearly everywhere. Answers must be truthful and attested by the client.
- Compliance requirements: signed scope/authorization letter for simulations; client employees only; no credential harvesting kept; truthful questionnaire answers signed by client; data-protection notice to employees where required (EU/UK works councils); tax reporting
- Platform availability: Direct invoicing (Wise/Payoneer) and Upwork pay out in nearly all reference countries.
Risks
- liability for inaccurate answers
- trust barrier without certifications
- simulation complaints from staff
Evidence that people get paid
Security questionnaires are routine in B2B procurement. Gophish is free and open-source, so simulations need no capital. KnowBe4 runs a partner program for VARs, MSPs and consultants but publishes no margins, minimums or entity requirements (unverified). Demand figures unverified.
Sources
- https://getgophish.com/
- https://www.knowbe4.com/partners
- https://investors.upwork.com/static-files/468fcdc3-31a4-4432-9d1e-f8b50122dd65
- https://stripe.com/global
- https://www.payoneer.com/about/
Tags: b2b, security, compliance
Generated from data/strategies/b2b-services.json by npm run build:catalog. Edit the JSON, not this file.