6 min read · Written by Grant Rayner on 09 Aug 2023
Share by emailLast week, I provided an introduction to security consulting as a service. I proposed a definition for consulting in the context of security services. I also asked whether clients actually need security consulting services.
This week, I want to go a bit deeper by exploring some of the advantages and disadvantages of offering consulting services. I’ll also attempt to provide some form of summary judgement regarding whether you should include consulting services as part of your portfolio of products and services.
Let’s start with identifying some of the advantages of consulting as a service.
Integrating consulting services into your product and service mix offers you a number of advantages as an independent security professional.
The primary advantage of offering consulting services is that they demonstrate your expertise in your chosen speciality. By offering consulting services in a particular field, you are actively positioning yourself as an expert in that field. In fact, if you intend to focus on a specific niche, it would be unusual not to offer consulting services in that speciality.
Consulting services are well-suited to your role as an independent security professional. While many security services can’t be delivered by an individual, consulting is ideal for that approach.
As an expert in your chosen speciality, offering consulting services will enable you to charge higher fees for your consulting services in comparison to other services. Why are consulting fees higher? Consulting services involve the application of your unique expertise to a specific client problem, providing a tailored solution. As such, there are few substitutes. In addition, the value provided by a consulting service should go beyond the mere application of your time. These dynamics enable you to command a high fee.
Another important aspect to consider regarding pricing is that the price of your consulting services provides an anchor price for the other products and services you offer. I’ll explore the concept of price anchoring in more detail in future articles when I focus on how you can apply pricing theory as an independent security professional.
You’ll have quite a bit of flexibility regarding how you price consulting services. For example, you’ll be able to use value pricing for consulting services. In comparison, value pricing is less suited to other types of services, where you may be forced to charge by the hour or day.
As a service, consulting typically has lower overheads than other services. Unless you intend to subcontract some aspects of a project, there will be no other significant non-billable costs. As a result, in combination with higher fees, profit margins for consulting services can be higher than other services. Similarly, overheads for consulting will be significantly lower than those for products (as a broad category, products will typically have costs related to materials and labour).
One of the major benefits of consulting projects is that they will provide you with the opportunity to develop your skills as a professional. The process of identifying client problems and developing solutions to solve those problems will lead to new insights. You can then apply these insights to subsequent projects. Provided you’re able to fully capture the learnings from each project, you’ll be able to remain at the bleeding edge of your field.
As you deliver successful consulting projects, you’ll build out a compelling project portfolio. You can leverage this portfolio when discussing your background and experiences with potential clients. You can also detail relevant project experience in your proposals. This ‘proof of work’ is critical when trying to establish your credibility and convincing clients to take the risk to hire you as an independent security professional. Even more so when you’re competing against larger and more established companies for a particular project.
Consulting projects require a deep level of engagement with the client organisation. This engagement will enable you to develop relationships with individuals in the client organisation. Assuming you deliver the project to a high standard, the likelihood of working with a client on future projects is higher with consulting services than with other services. It’s also more likely that your clients will refer your services to others.
Delivering consulting projects provides a degree of flexibility. You have significant control over your time during a consulting project. Once a consulting project has finished, you can take a short break. In comparison, it’s more difficult to take time off when delivering retainer services or other services that requires your ongoing availability.
I’ve probably painted a rosy picture of consulting as a service. Let’s switch our focus to the negative aspects of consulting. As you’ll learn, while the disadvantages of consulting as a service are very real, they are also surmountable with some forethought and planning.
In addition to the advantages offered by consulting as a service, there are a number of disadvantages to consulting that you’ll need to acknowledge and address if you want to be successful.
The biggest challenge with offering security consulting services is that you’ll find it challenging to scale consulting services as an independent security professional. Consulting companies scale their services by adding manpower. As an individual, your potential revenue will be capped at the number of consulting days you’re capable of delivering, multiplied by your day rate. That’s not to say you can’t make reasonable money from consulting. It’s just that you’ll need to recognise that there is a ceiling. To move beyond that ceiling, you’ll need to innovate and explore other opportunities.
If you only focus on consulting services, you’ll find your revenue will fluctuate significantly from month to month. When you’re delivering a consulting project, you’ll have limited time and energy for other key activities, such as promoting your services and winning new projects. Once you complete a project, there will be a lull in billable activity as you engage with potential clients to win your next project, then start the process of delivering that project. This dynamic will lead to a dip in revenue between projects. If this is something that concerns you, you’ll need to work to integrate consulting with other services to reduce these fluctuations.
There’s always going to be a risk of ‘scope creep’ with consulting projects, where clients expect more than what was initially agreed upon. Scope creep will always have the potential to lead to dissatisfaction and disputes, and can ruin what would have otherwise been a successful project. You’re more likely to experience scope creep with consulting services than with other services, such as conducting assessments or delivering training.
As an independent security professional, some clients may perceive that you can be easily pushed around and coerced into delivering more value than they’re willing to pay for. Accordingly, you’ll need to learn to write (or review) contracts to protect against this. You’ll also need the courage to stand your ground where it makes sense to do so.
As I noted in last week’s article, not all clients actually need security consulting services. In fact, I would argue that very few organisations require such services. Your clients will need work done, but rarely will this be strategic work that meets the definition of ‘consulting’. As a result, you may find that you struggle to find clients willing to initiate security consulting projects.
It’s difficult to market and sell consulting services as an independent security professional. You’ll almost certainly be going head to head with larger security companies. While a large firm has people on salaries that can engage in marketing and sales activities, every time you participate in a sales call or write a proposal you’re not earning revenue. Of course, you need to invest time and marketing and sales. The challenge is how you apportion your valuable time to ensure success and minimise wasted time and effort. Large companies can absorb this time and effort. As an independent security professional, you can’t.
Consulting projects are also more complex to manage and difficult to deliver than other services. Because of the increased value of consulting projects (due to higher fees), you’ll run up against the need to submit detailed proposals. In addition, the process of delivering most consulting projects will require not only a substantial amount of time but also a significant amount of intellectual effort. You’ll need to balance this against services that require significantly less effort for slightly less revenue.
In addition, you’ll probably find that the complexity of some consulting projects will make it difficult to run multiple projects concurrently. Again, this will impact your revenue potential.
There will always be risks relating to legal liability for consulting projects. The key is to design consulting services that minimise liability risks. Not as easy as you might think.
Given these disadvantages, should you actually incorporate consulting services into your product and service mix?
Yes. You should absolutely offer consulting services as an independent security professional. Consulting services enable you to demonstrate your unique knowledge and expertise to potential clients.
Assuming you’ve spent a few years building your experience in larger security companies before setting off on your own, you will be uniquely positioned to offer credible consulting services. The fact is that you should have more project experience than most of your peers in the larger security companies.
The challenge, of course, is to ensure that you focus your consulting services on the right problems with the right clients. There must be a demand for whatever consulting services you plan to provide. Without that demand, and without a coherent portfolio of products and services, there’s a good chance your business will fail.
Of course, all this assumes that you intend to centre your business on the delivery of services. If you intend to offer products, then consulting may not be so relevant.
Next week, I’ll go a level deeper into different approaches you can take to integrate consulting into your mix of services. I’ll also share some of my own experiences designing consulting services.