4 min read · Written by Grant Rayner on 04 Oct 2023
Share by emailRecent articles have focused on different types of services you can provide as an independent security professional. So far, I’ve covered consulting and training services in detail.
Another service you can provide is response. Response services typically relate to either security response or crisis response. In practice, a major incident occurs, and you immediately deploy to the incident location to provide support to your clients. The incident could be a major crisis, such as a natural disaster or a terrorist attack. Alternatively, the incident could be internal to the company, such as a major scandal.
In this article, I’ll discuss the advantages and disadvantages of providing response services. I’ll also touch on the different approaches you can take to deliver these services. Next week, I’ll continue by focusing on pricing and how to determine whether to deploy.
Let’s start by exploring some of the advantages of response work.
As an independent security professional, there are some significant advantages in providing response services for your clients.
The experience you’ll gain from responding to different incidents, and the confidence that comes with that experience, will be invaluable for your professional development.
The experiences you’ll gain during response work will provide you with robust case studies. You can share these case studies in your newsletter to promote your services. You can also include case studies from your response work in your training to showcase your capabilities.
You’ll almost certainly onboard new clients during a response project. These clients may then be willing to engage you for other work, perhaps including consulting and training.
One of the most valuable aspects of response work is that you’ll be supporting your clients during a time of need. Your clients will remember this and your business relationship with them will strengthen as a result.
Successful response work can help you build your reputation as a competent and reliable professional, increasing the likelihood you’ll attract new clients and projects.
Response work can be very well paid. At a minimum, you can expect to earn at least US $2,500 a day. In some cases, you may be able to work with multiple clients on a part-time basis, earning even more.
As I’m sure you would expect, response work also comes with some disadvantages.
Incidents can occur without notice. You’ll therefore need to be ready to deploy with minimal warning. For some of you reading this, your ongoing commitments at home will rule out any possibility of deploying at short notice. A realistic approach is to simply state that you provide response services on a ‘best effort basis’. That will give you some flexibility to pick and choose when you deploy
If you’re already engaged in other projects, it may not be possible to deploy at short notice. You should always give priority to existing work and not change project schedules or delay deliverables.
Fortunately, major incidents seldom occur. As a result, it wouldn’t be advisable to structure your business solely around response services. Instead, response services should be a supporting service. If you offer crisis management consulting and training services, for example, it would make sense that you also offer crisis management response services.
Response work may require you to go into potentially dangerous environments, which could impact your physical and psychological safety. You’ll therefore need to carefully assess the risks before you commit to responding to a specific incident.
Depending on where you deploy, there may be significant costs involved. Aside from the costs of getting there, it’s also likely you will need to pay for accommodation, ground transport, fixers, and other support. If you’re unable to get sufficient work, you may not be able to recover these costs.
On balance, response work is beneficial provided it doesn’t interfere with your other work.
Let’s explore the different approaches to delivering response work.
There are several different approaches you can take to response work. The paragraphs below will introduce you to those approaches, and share some of the practical implications as you consider which approach may be best for you.
Your first option is to provide response services directly to your clients. You will communicate the fact that you provide these services on your website.
The advantage of this approach is that you can work with as many clients as you can manage, and you’ll gain the direct financial benefit of these relationships.
The challenge with offering response services as an individual is that there’s no backup. When your client calls, they’re calling because they want you to deploy. You’ll need to drop everything and go. Being on call for short-notice deployments isn’t sustainable and will almost always impact your performance on other projects.
The second option is to enter into agreements with one or more larger security companies as a response consultant. In this option, you’ll be sub-contracting your services to that company. If there’s an incident, the company will contact you to check your availability. If you’re available, you’ll deploy and they’ll pay you for your time.
Similarly to offering response services yourself, the challenge here is that the company may contact you at any time. It’s okay to not be available for some assignments. Of course, the company will only accept so many rejections before they push you down or even off their list of subcontractors.
While on the positive side there’s a high likelihood you’ll be paid for your time, the disadvantage of this approach is that you’ll be paid the same daily rate, regardless of how many clients you support on the ground.
Another benefit of this approach is that larger security companies will have large client lists, which means they’ll be able to direct clients your way without you haven’t to find clients yourself. If you’re relatively new to response work, this option may be a good way to start.
One approach you might find useful is to be a response consultant for organisations not in your region. For example, if you were based in the Middle East, you could be contracted as a response consultant for a company in the US or UK. The fact that you’re living and working in the region will help ensure you have a good knowledge of the risk environment. You may also have your own network of contacts that you can activate to support the project. Most importantly, because you’re in the region you will be able to get the to the incident location quickly.
Of course, you can adopt a hybrid approach by offering response services yourself and also being available to sub-contract to larger security companies. Where you may find challenges with this approach is in situations when there are competing schedules, particularly in the case where the larger security company asks you to complete a task at the same time you need to complete a task for one of your own clients.
Next week, I’ll focus on pre-emptive deployments, pricing, leveraging response work to create products, and deciding when to deploy.