Hook

Video Poster Image

Key Takeaways:

  • Process Before Platform
    Map your customer journey first. Then choose the tools that support it. Automation without clarity just amplifies the chaos.
  • Build a Single Source of Truth
    Stop juggling multiple systems. Pick one core platform for data and integrate everything else into it.
  • Automate the Repetitive, Personalise the Rest
    Automate the predictable. Keep the personal moments human. That’s how you stay connected while scaling.
  • AI Should Be Your Teammate, Not Your CEO
    Use AI to assist, not decide. It should lighten your cognitive load — not replace your judgment.

If your business feels like it’s held together with spreadsheets and wishful thinking, this episode will show you how to scale without losing the soul of your brand.

Sub-Header 1

Sub-Header 2

Sub-Header 3

Sub-Header 4

Sub-Header 5

Sub-Header 6

Sub-Header 7

Sub-Header 8

Sub-Header 9

Sub-Header 10

How to Scale a Cybersecurity Consultancy Past £500k

Jul 14, 2026
Diagram of the Three Defences framework for scaling a cybersecurity consultancy past £500k

By Deirdre Martin, Neuro-Strategic Business Coach and StoryBrand Certified Guide. Last updated July 2026.

Key takeaways

  • Count how many clients your cash flow actually depends on. If you depend on 3 or fewer to carry the month, you have concentration risk, and more sales won't fix it.
  • Growing means revenue rises and the cost of producing it rises with it. Scaling means revenue rises while the amount of you it takes stays flat.
  • Defence one, defend the revenue. An offer ladder and recurring agreements so no single relationship carries the month.
  • Defence two, defend the price. Enforce the terms, scope and renewals you've quietly let slide. That money is already in the business.
  • Defence three, defend the decisions. Write down who can decide what, so every judgement call stops routing back to your desk.

"Growth adds floors. Scaling moves the load."

One phone call. That's all it took to blow a hole in my client's cash flow. One big customer, changing their plans.

And here's the scary part. On paper, their business was flying. Revenue was steady around the £500k mark, the best it had ever been. Twelve clients on the books, but 3 of them covering most of the business overheads every month.

My client thought he had a sales problem. His intention was to go win more work, to fill the hole. But our call had shown him something else. It had shown him what his revenue was actually made of. A small number of relationships, on which his monthly outgoings were heavily dependent. 

What got that business steady and growing again, came down to 3 protective moves I call the Three Defences. On paper they look like the wrong moves. That's exactly why they work.

Why do cybersecurity consultancies stall around £500k?

Most cybersecurity consultancies stall around £500k because of concentration, a small number of clients and relationships carrying most of the revenue, with every meaningful decision still routing through the founder. It looks like a sales problem. It behaves like a structural one, and more leads won't fix it.

Half a million in revenue, and one late invoice can still wreck the month. That's the £500k squeeze. And concentration is a risk you already know professionally. You'd flag it in a client's supplier chain inside 10 minutes. It just never gets priced into your own revenue.

As one cyber founder I work with puts it, "One big client delay or a late invoice and the whole month collapses."

In a cyber consultancy, that concentration usually hides in 3 places.

The first is the whitelabel work. It feels great. You have steady projects at decent day rates, without a minute of selling, and you don't need to worry about managing the client relationship. Strip it back though, and it's one relationship. The business that brought you in... their pipeline decides your income for the month ahead. And every hour of it builds their brand's reputation instead of yours.

Then there's the contractors. Which also feel great and like less responsibility, because they're flexible, and it keeps the payroll light, except nothing gets retained. And, rarely can you hand off key business decisions. So you end up with no documented standard, or capability that stays in your business when the contract ends. And, you're still the quality gate on every deliverable.

And then there's the anchor client. Everything you do in your business revolves around them. You won a major contract, so you're whitelabelling out work, and you have contractors. But instead of concentration risk across three clients, yours is on one. You have zero other income streams. 

What's the difference between growing and scaling a consultancy?

Growing means revenue goes up and the cost of producing it goes up in direct correlation. More clients results in more hours and  more of you. Scaling means revenue goes up while the amount of founder time it takes stays flat and while costs may rise your profit margins are relatively steady. Most consultancies at £500k are growing, and the founder is paying for it personally in time, physical, emotional, mental and spiritual effort.

Think of it like a building. Every year you add another floor. But there's only one weight-bearing wall. You. So every floor you add puts more weight on that one wall.

Which is where the Three Defences come in. The first one does what it says.

Defence one: how do you protect your revenue?

You protect consultancy revenue by building an offer ladder, your expertise packaged at more than one level, and by converting project spikes into recurring agreements with named monthly deliverables. Spread across a ladder and a recurring base, so you are not reliant on any one single deal or relationship to cover your monthly costs on its own.

For my client, the ladder meant a way in at the bottom, a flagship in the middle, and ongoing value sitting above both. The recurring agreements turned feast-or-famine projects into consistent, reliable monthly recurring revenue he could bet on.

And packaging pays twice. Another client I worked with grew from roughly £95k to £385k in a year once packaged offers replaced bespoke everything. The day rate went up. Delivery time came down. Same expertise, just a slightly different structure.

Now, I know what some of you are thinking, because my clients say it out loud. "Clients hate retainers." What they hate is paying monthly for vague availability and not being clear on what value they're getting. A recurring agreement with named, visible deliverables every single month is a different animal. Your buyers already understand the model. They buy managed services all day long.

A question worth sitting with.

How many clients does your cash flow actually depend on right now?

You don't have to name them. You just have to know the number.

Defence two: how do you stop underpricing your work?

You stop underpricing by enforcing what you've already agreed: payment terms held, scope boundaries restored, renewals repriced to today's rates, day rates that reflect the business you are now. Past £500k, a serious amount of the money you're looking for is already inside the business, leaking out of deals you've won.

Scope that crept while the fee stood still. Payment terms that exist on paper and never get enforced. Renewals priced at rates you set 3 years ago because raising them felt awkward.

There's a reason smart founders under-enforce, and it's wired into all of us. A loss weighs roughly twice as much on us as an equivalent gain. So the possible loss of one client outweighs the certain gain of charging everyone similar rates, every time. That's how technically brilliant founders end up bankrolling their clients' worst habits without ever noticing.

"If I charge more, I'll lose clients." Maybe you'll lose one. The one who was costing you margin, your weekends, and a fair chunk of your self-respect.

This defence costs you nothing. Enforcement needs no marketing spend and adds nothing to your delivery load. It's just terms, held.

Defence three: how do you stop being the bottleneck?

You stop being the bottleneck by moving decisions, which means decision rights written down with real value thresholds, a delivery standard that lives outside your head, and a weekly rhythm where problems get solved by the people closest to them. Hiring alone won't do it, because hiring moves the work without moving the decisions.

This is the move founders get half right. They source good people to add to their payroll, and every problem still queuing outside one door. Yours.

"If I don't do it, it won't be done right." I hear it constantly, and I understand where it comes from. But in nearly every business I've been inside, the team had the ability. What they'd never been given was permission. No one had written down who can decide what, up to what value, without asking.

The first two defences protect the money. This one protects you. It's the same shift I unpack in how the smartest entrepreneurs scale back to grow bigger, moving from carrying the business to leading it.

Here's the part I want you to sit with. Every one of those moves was protective. And the growth arrived anyway, because a business that can take a punch is one buyers trust, and good people stay in. You're a risk professional. Mitigating risk is your native language. The Three Defences are the discipline you already respect, pointed at your own commercials for once.

Two mistakes that will cost you wasted time and effort

The first is hiring as the fix. Adding people, staff or contractors, without moving decision rights just gives you a bigger payroll and the same wall. Hire before defence three exists and you've bought expensive company for your bottleneck.

The second is demolition. Some founders hear "concentration risk" and want to torch the whitelabel work or fire the anchor client next week. Don't. That income is load-bearing right now. Build the ladder and land the recurring base first, then rebalance from a position of strength. Mapping your client journey end to end shows you where the load actually sits before you move anything.

Where to start this week

Start by finding your weakest defence. Is your exposure the revenue, the price, or the decisions? Fixing them in the right order is the whole game at this stage.

If you're not sure of your answer, I've built a short scale-readiness audit that shows you exactly where you're exposed and what order to fix it in. It takes a few minutes, and you'll leave with your weakest defence named. Take the scale-readiness audit here.

Past £500k, the founders who get free are the ones who start asking a different question. What could this business survive? A month with you out of the room. A client changing their plans without warning. A late invoice that never touches payroll. A price rise that sticks.

When the answer is "quite a lot, actually," that's when revenue becomes something you can plan around. Predictable, and yours.

Growth adds floors. Scaling moves the load.

Frequently asked questions

What is client concentration risk in a consultancy?

Client concentration risk is when a large share of your revenue depends on a small number of clients or relationships. In a cybersecurity consultancy, it usually hides in white-label work, contractor-delivered projects, and one unnamed anchor client. If 3 or fewer clients carry your month, a single delay can wreck your cash flow.

What are the Three Defences for scaling a consultancy?

The Three Defences are defend the revenue (an offer ladder plus recurring agreements), defend the price (enforcing terms, scope and renewal rates), and defend the decisions (written decision rights so the business runs without every call routing to the founder). The first two protect the money. The third protects the founder.

Do clients actually hate retainers?

What clients dislike is paying monthly for vague availability. A recurring agreement with named, visible deliverables each month is something buyers understand and happily pay for, because it mirrors the managed services they already buy.

Will raising my prices lose me clients?

You might lose one, usually the client already costing you margin and time. Loss aversion, the finding that a loss feels roughly twice as heavy as an equal gain, is why founders avoid the conversation. Repricing renewals and enforcing terms is often the fastest money in the business because it costs little to nothing extra to deliver.

How do I stop being the person every decision comes back to?

Write down decision rights with real value thresholds, so your team knows what they can solve without asking. Put the delivery standard somewhere other than your head, and establish a weekly rhythm in which problems are solved by whoever is closest to them.

Should I drop my white-label work to reduce concentration risk?

Not straight away. That income is load-bearing. Build your offer ladder and land a recurring base first, then rebalance once you're not depending on any single source.

 

Related reading

Resources mentioned

  • Scale-readiness audit. A short assessment that names your weakest defence and the order to fix them in. https://www.deirdremartin.ie/cyberscalediagnostic
  • Thinking, Fast and Slow by Daniel Kahneman. The source for prospect theory and loss aversion, the reason raising your price feels harder than it should.
  • Strategy Day with Deirdre. One day to map your positioning, your offer ladder and your next moves, and leave with a plan you can run straight away.
  • Millionize, The Built Beyond You System. For cybersecurity founders ready to turn founder-held expertise into a business the team can sell and deliver without everything going through them. deirdremartin.ie/millionize

Stay connected with episodes, news and behind-the-scenes updates!

We hate SPAM. And we will never sell your information, for any reason.

Frequently Asked Questions

Resources Mentioned

Recent Episodes

How to Scale a Cybersecurity Consultancy Past £500k

NIS2 Is Filling Your Pipeline. Here's Why Your Cybersecurity Consul...

The Real Reason Buyers Pick the Big 4 Over Better Cybersecurity Firms