First 90 Days: Launch Checklist

Most people searching this term already know what breach and attack simulation is. What they don't have is a sequenced plan for turning that expertise into a funded, sellable business. Here's the order that keeps cash flow intact while you build credibility with enterprise buyers.

• Weeks 1-3: Register the entity, open a business bank account, and secure technology E&O plus cyber liability insurance before you accept your first client contract
• Weeks 2-5: Choose a platform strategy: reseller of an established BAS vendor, or a build-your-own stack on open-source frameworks (see the tooling section below)
• Weeks 4-8: Build a lab environment and run 2-3 unpaid or heavily discounted pilot engagements with contacts from your professional network to generate your first ATT&CK-mapped sample reports
• Weeks 6-10: Start the CREST Pathway application (UK) or begin SOC 2 Type II readiness work (US); both take months, so the clock needs to start early
• Weeks 8-14: Approach mid-market prospects directly, not enterprise, since their procurement cycles are too long for a pre-revenue business, and close your first 2-3 paid retainers
• Weeks 12-16: Use signed retainer revenue and pilot case studies to apply for SBA 7(a) financing (US) or a Start Up Loan (UK) to fund a second analyst hire

The single biggest planning error at this stage is assuming enterprise logos will close in the first quarter. They won't. Mid-market clients with a named CISO or head of IT, 200-2,000 employees, and an existing compliance driver (PCI DSS, a cyber insurance renewal, a client audit) close far faster and should make up the bulk of your first-year pipeline.

A second common planning error is treating the first 90 days as a single, linear sequence. In practice, the compliance track (CREST or SOC 2 readiness) and the sales track need to run in parallel from week four onward, because both take months to bear fruit and neither can be compressed by working harder in isolation. Founders who wait until compliance work is finished before starting sales conversations routinely lose 3-4 months of pipeline-building time they can't recover.

What Investors and Lenders Actually Look For at This Stage

Because this is a services business with no physical inventory, lenders and angel investors weigh three things heavily: the founder's prior operating experience (ideally a named prior employer with recognisable security credibility), evidence of at least one paid or pro-bono pilot engagement with a documented outcome, and a realistic cash-flow model that accounts for the 3-9 month enterprise sales cycle rather than assuming linear monthly revenue growth from day one. A business plan that shows all three, alongside a clear compliance roadmap, is materially more fundable than one built purely around market-size statistics.

What It Actually Costs to Start

Launching a security-testing business built around automated breach and attack simulation typically requires $45,000 to $220,000 in the US, or £35,000 to £175,000 in the UK. The range is wide because the biggest lever is your platform decision: reselling an established BAS vendor's licence is faster to market but carries recurring licensing fees, while building on open-source frameworks (Caldera, Atomic Red Team) is cheaper up front but demands more in-house engineering time.

Cost Breakdown

• BAS platform licensing or lab tooling: $12,000-$60,000 (£9,500-£47,000)
• Cloud lab and attack-range infrastructure: $6,000-$30,000 (£4,700-£23,500)
• Certifications and analyst training (OSCP, GPEN, GXPN, CREST Practitioner): $4,000-$18,000 (£3,200-£14,000)
• Professional indemnity + cyber/tech E&O insurance: $3,000-$9,000/yr (£2,400-£7,000/yr)
• CREST accreditation pathway (UK) or SOC 2 readiness (US): $8,000-$35,000 (£6,300-£27,500)
• Sales, marketing, and report design: $5,000-$20,000 (£4,000-£16,000)
• Working capital (3-6 months, given long enterprise sales cycles): $12,000-$50,000 (£9,500-£39,000)

Funding Routes

In the US, an SBA 7(a) loan is the most practical route once you have signed retainer revenue to show a lender; most first-time BAS founders can't qualify pre-revenue because the business has no physical collateral. Our bespoke business plan service includes SBA-compliant formatting and lender-ready financial projections. In the UK, the Start Up Loans scheme offers up to £25,000 at 6% fixed interest with free mentoring, which is often enough to cover the CREST Pathway application and first analyst certification round. Founders with an existing security career frequently self-fund the first 6 months from severance or savings and use external financing only once retainer contracts are signed.

A smaller but growing route is vendor partner financing: several BAS platform vendors run reseller or MSSP partner programmes that defer a portion of first-year licensing fees in exchange for a revenue-share arrangement once a partner signs paying clients. This can meaningfully reduce the up-front cash requirement in the "platform licensing" line item above, though it usually comes with a minimum client-count commitment within the first 12 months, so it should be modelled carefully against your realistic sales pipeline rather than assumed as free capital.

Reducing the Startup Cost Floor

Founders bootstrapping without external financing typically compress the $45,000-$220,000 range toward its lower end by making three trade-offs: choosing the open-source tooling path over a paid platform licence in year one, delaying full CREST or SOC 2 certification until the first 3-4 paying clients are signed (operating instead on Cyber Essentials or an ISO 27001 gap-assessment as an interim credibility signal), and running the lab environment on pay-as-you-go cloud infrastructure rather than provisioning dedicated capacity up front. None of these trade-offs are free; they shift cost into founder time and slightly slower enterprise procurement approval, but they are a realistic way to get to a first signed contract on $45,000-$60,000 rather than the full $220,000 ceiling.

Platform & Tooling Choices

Your platform choice is the single decision that shapes both your cost base and your positioning. The three named commercial leaders in this space are Cymulate, AttackIQ, and SafeBreach, alongside strong mid-tier options like Picus Security and XM Cyber for attack-path validation specifically.

• Cymulate: modular platform covering email, web, endpoint, lateral movement and data exfiltration vectors; commonly reported reseller/partner pricing starts near $7,000 for a one-month, 7-vector bundle
• AttackIQ: deep MITRE ATT&CK integration, strongest fit if your pitch to clients centres on validating the full kill chain rather than individual controls
• SafeBreach: continuous simulation with a large, frequently updated attack playbook; a good fit for clients who want "always-on" validation rather than scheduled campaigns
• Picus Security / XM Cyber: narrower attack-path and exposure-validation focus, often used as a complement to a primary BAS platform rather than a standalone offering
• MITRE Caldera / Atomic Red Team (open source): free adversary-emulation frameworks that let a technically strong founder build a lower-cost custom offering, at the cost of more engineering and reporting work in-house
• Reporting layer: whichever platform you choose, plan for a reporting/dashboarding tool (or in-house templates) that translates ATT&CK technique IDs into board-readable risk narratives. This is what turns a technical output into a renewed contract

Most successful boutique practices don't build the whole stack from scratch; they become a certified partner or reseller of one primary platform, add a lightweight open-source layer for edge cases, and differentiate on the quality of human-written analysis layered on top of the automated output.

Comparing the Three Common Business Models

Nearly every practice that survives past year two ends up on the hybrid model regardless of where it started: pure resellers add an in-house reporting layer once clients start asking for narrative context, and self-built shops eventually license a commercial platform once client volume outpaces what a small engineering team can maintain internally.

How a Delivery Engagement Actually Runs

Investors and lenders reading a business plan for a services company want to see the delivery mechanics spelled out, not just the pricing. A typical BAS engagement, once a client is signed, follows a repeatable four-stage cycle that a small team can run without heavy customisation per client.

• Scoping (week 1): map the client's attack surface, agree which vectors and environments are in scope, and set a testing cadence: weekly, bi-weekly, or monthly depending on contract tier
• Baseline run (weeks 1-2): execute an initial full-vector simulation to establish a baseline gap report, mapped to MITRE ATT&CK technique IDs, that becomes the reference point for every subsequent run
• Ongoing validation (continuous): run scheduled simulations against the agreed cadence, plus ad-hoc runs triggered by significant control changes on the client side
• Reporting and remediation guidance (recurring): deliver a narrative report translating technique-level findings into prioritised remediation actions, typically reviewed live with the client's security or IT lead on a monthly or quarterly call

Staffing this cycle efficiently is what separates a profitable boutique practice from one that burns out its analysts. A single senior analyst can typically manage the ongoing validation and reporting workload for 6-10 mid-market retainer clients simultaneously once the baseline work is done, assuming the platform handles the mechanical simulation execution and the analyst's time is concentrated on scoping, interpretation, and client-facing reporting rather than manual test execution.

A second staffing decision worth planning for early is when to hire a dedicated client-success or account-management function separate from the technical delivery team. Below roughly 8-10 clients, most founders handle both delivery and account management personally; beyond that threshold, separating the two roles tends to protect renewal rates, because a technical analyst under delivery pressure during peak testing weeks is a poor substitute for someone whose full-time job is managing the relationship and flagging renewal risk early.

Documentation discipline is a delivery-quality issue as much as a compliance one. Every baseline run, technique tested, and remediation recommendation should be logged in a format that survives an analyst leaving the business. A surprising number of early-stage practices carry undocumented tribal knowledge about a client's environment in one person's head, which becomes a serious operational risk the moment that person is unavailable during a renewal negotiation or a client-side security incident. Building a lightweight, consistent engagement log from day one is cheap insurance against that risk, and it also becomes valuable due-diligence material if the business is ever acquired.

Licensing, CREST & Compliance

United States

• No federal license is required to operate a security-testing or BAS consultancy
• SOC 2 Type II readiness is not legally mandatory but is expected by most enterprise buyers before they will sign; budget $15,000-$40,000 for first-year audit and preparation
• State business registration and technology E&O plus cyber liability insurance ($3,000-$9,000/yr)
• Working fluency in client-facing compliance frameworks: HIPAA, PCI DSS, NIST 800-171/CMMC (for defense-adjacent clients), and GLBA (for financial services clients)

United Kingdom

• CREST accreditation: the Council of Registered Ethical Security Testers runs a three-stage pathway (Pathway → Pathway+ → full Member), with organisations expected to progress from entry-level to full accreditation within roughly two years; membership costs range from £1,200 to £26,500, plus £275-£800 per individual certification
• ISO 27001 and ISO 9001 alignment: expected alongside CREST accreditation by most enterprise and public-sector procurement teams, typically £8,000-£25,000 for initial certification
• Cyber Essentials / Cyber Essentials Plus: administered by IASME on behalf of the NCSC; often a hard procurement requirement even before CREST is discussed, £300-£5,000+ depending on level
• Professional indemnity insurance with minimum £1M-£5M cover, typical for enterprise contracts

European Union

Any client telemetry captured during a simulation engagement is subject to GDPR-compliant handling, and the NIS2 Directive is increasingly pushing EU critical-infrastructure operators toward continuous security validation programmes rather than point-in-time testing alone: a genuine market tailwind for a BAS-focused practice targeting EU-regulated clients.

A Glossary of Terms Your Business Plan Should Use Correctly

Lenders, investors, and enterprise procurement reviewers expect these terms to be used precisely, not interchangeably:

• MITRE ATT&CK: a publicly maintained knowledge base of adversary tactics and techniques, used as the common reference framework for reporting simulation results
• Attack surface: the total set of points (network, endpoint, cloud, identity) an adversary could target; the scoping unit most retainer pricing is based on
• Purple teaming: a collaborative exercise where the offensive (red) and defensive (blue) teams work together in real time, often positioned as a premium add-on to standard BAS retainers
• Control validation: the practice of proving that a specific security control (a firewall rule, an EDR detection, a SIEM alert) performs as intended against a real technique, rather than assuming it does
• Exposure management: the broader discipline BAS sits inside, covering vulnerability, misconfiguration, and attack-path exposure across an environment
• Attack path validation: a narrower technique, offered by vendors like XM Cyber, focused specifically on mapping how an attacker could chain multiple weaknesses to reach a critical asset
• Adversary emulation: replicating the specific tactics of a named, real-world threat actor (rather than generic techniques) to test defences against threats most relevant to the client's sector
• Detection engineering: the practice of writing and tuning the detection rules a BAS engagement is ultimately testing; a natural adjacent service line for a practice that wants to move beyond pure validation

Precision with this vocabulary matters commercially, not just academically. A prospective client's security team will often test a new vendor's credibility in the first call by listening for whether these terms are used correctly and consistently. Conflating "vulnerability scanning" with "breach and attack simulation" in a sales conversation is one of the fastest ways to lose credibility with a technically sophisticated buyer.

Pricing Retainers & Margins

Continuous BAS-as-a-service retainers typically run $2,500 to $12,000 per month per client, scaled by attack-surface size and the number of vectors under test. Project-based validation engagements, by contrast, run $7,000 to $91,000 per engagement. Cymulate's published pricing for a seven-attack-vector bundle spans exactly that range between a one-month and a twelve-month term, according to buyer-facing pricing analyses. Boutique consultancies operating a BAS platform on behalf of mid-market clients usually price between these two figures, favouring recurring retainers over one-off projects because retainers are what make the business valuable to a future acquirer or investor.

Worked example: a 2-person BAS validation practice running 10 mid-market retainer clients at an average of $4,500/month generates $540,000 in annual recurring revenue. After platform licensing ($90,000), two senior analyst salaries ($220,000 combined), cloud lab costs ($18,000), insurance and compliance ($12,000), and sales/admin overhead ($60,000), the business nets approximately $140,000 (a 26% margin) in its first year, before reinvesting in a third analyst hire to support renewal-season workload.

Net margins for the sector as a whole typically fall between 20% and 38%, with the higher end reserved for practices that have moved most clients onto multi-year retainers and reduced new-business acquisition cost as a share of revenue.

Where the Extra Revenue Streams Come From

Beyond the core validation retainer, most established practices layer in two or three additional revenue lines once the base client relationship is established: purple-teaming workshops billed separately from the standard retainer (typically $5,000-$15,000 per engagement), quarterly executive readouts positioned as a premium add-on for clients who want board-ready reporting rather than raw technical output, and compliance- mapping add-ons that translate simulation results directly against a specific framework (PCI DSS, HIPAA, NIS2) for clients under active audit pressure. These additions rarely exceed 20-30% of total revenue in year one but become an important margin lever as the client base matures past its first renewal cycle.

A second lever worth modelling explicitly is contract length. Clients on 12-month retainers with quarterly billing churn at a meaningfully lower rate than clients on rolling monthly contracts, largely because the annual commitment forces a budget conversation with finance rather than leaving the relationship exposed to a single line-item cut during a cost-review cycle. Business plans that show a deliberate strategy for moving clients from monthly to annual billing within the first renewal cycle tend to read as more investable than plans that treat all retainer revenue as equally durable.

The BAS Market in 2026

The global automated breach and attack simulation market was estimated at $1.05 billion in 2025, with one long-range forecast projecting growth to $16.72 billion by 2035, which implies a compound annual growth rate well above 30% (Precedence Research, 2025). Other research houses put current-year figures anywhere from roughly $275 million to $1.5 billion depending on methodology and scope definition, which is itself a signal: this is a young, fast-moving category where analyst firms haven't converged on a single figure, and a founder's business plan should treat published market-size numbers as directional rather than precise.

Growth is driven by three converging pressures: the rising sophistication of attacker tooling (much of it now AI-assisted), regulatory pushes like NIS2 in the EU that reward continuous validation over annual audits, and a persistent shortage of skilled in-house red-team talent that pushes mid-market organisations toward outsourced or hybrid validation partners rather than building the capability internally.

Most operators stop their market research at the vendor landscape. The number that actually drives unit economics for a services business in this space is renewal rate, not attack-vector count. A BAS practice that keeps clients past the first annual contract compounds revenue far faster than one that wins new logos every quarter to replace churn.

The UK market sits inside a broader European cybersecurity services sector that is expanding on the back of NIS2 transposition deadlines and a wave of cyber insurance renewals that increasingly require evidence of control testing, not just policy documentation. For a UK-based founder, this means the near-term addressable market is disproportionately weighted toward regulated mid-market firms in financial services, healthcare, and critical infrastructure adjacent sectors, rather than the broad SME market that dominates most other business-services categories on this site.

Globally, the divergence in analyst estimates (from roughly $275 million to $1.5 billion depending on methodology) mostly comes down to scope: some reports count only dedicated BAS platform revenue, while others fold in adjacent exposure-management and attack-path-validation tooling. For business-planning purposes, the more useful number is not the total addressable market but the realistic serviceable segment: mid-market organisations with 200-5,000 employees, an existing security budget, and a compliance driver forcing them to demonstrate control effectiveness rather than simply document policy.

Questions Buyers Keep Asking

These recur constantly in enterprise security-buyer research and are worth addressing directly in your own sales materials and business plan:

• "Will BAS flag things our SIEM already catches?" Often yes, and that's the point, BAS proves your existing detection rules actually fire in practice rather than assuming they do because they were configured correctly on day one.
• "How is this different from red teaming?" Red teaming is a broader, more creative, human-led engagement simulating a specific adversary; BAS is narrower, automated, and repeatable, making it better suited to frequent, ongoing control validation between full red-team exercises.
• "Do we still need an annual penetration test if we run BAS continuously?" Yes, most compliance frameworks (PCI DSS, CREST-based procurement) still require periodic human-led testing, and BAS complements rather than replaces it.
• "What's the fastest way to prove ROI to a CISO?" A short, scoped pilot (2-4 weeks, one or two attack vectors) that produces an ATT&CK-mapped gap report closes far more deals than a lengthy sales deck.
• "Can BAS run safely in a production environment?" Reputable platforms are built to run non-destructively against production systems, using controlled techniques rather than live malware, but most practices still recommend an initial pilot in a staging or segmented environment to build client confidence before expanding scope.
• "How often should simulations run?" Weekly or bi-weekly cadences are the most common baseline for continuous retainers, with critical control changes (a new firewall rule, an EDR policy update) triggering an ad-hoc validation run outside the standard schedule.
• "Do we need a dedicated in-house team to act on the findings?" Not necessarily. Many boutique BAS practices also offer a remediation-guidance layer, working alongside a client's existing IT or security team rather than requiring them to build new internal capability from scratch.

Sample Business Plan Preview

Here's an extract from a plan built for a founder launching a BAS-focused validation practice, so you can see exactly what a bespoke plan from our team looks like:

What's in the Template

Every Avvale business plan template includes these sections, pre-structured for your industry:

• Executive Summary, Your business at a glance, written to hook investors or lenders in 60 seconds
• Company Overview, Legal structure, ownership, platform strategy, and founding story
• Industry Analysis, Market size, growth trends, and the regulatory landscape driving demand
• Customer Analysis, Target buyer profiles (CISO, IT director, compliance lead) and their triggers to buy
• Competitor Analysis, Vendor and boutique-consultancy competitive mapping and your differentiation strategy
• Marketing Plan, Channels, messaging, and pilot-to-retainer conversion strategy
• Operations Plan, Engagement workflows, reporting cadence, and analyst staffing structure
• Management Team, Founder bios, advisory board, and key hires planned

The optional Financial Forecast add-on (included in our $300/£250 and $1,000/£800 packages) provides a 5-year Excel model with income statement, cash flow, balance sheet, break-even analysis, and startup capital requirements, formatted for SBA lenders or UK Start Up Loan reviewers.

Related reading: our industry-specific business plan template library also covers the adjacent cybersecurity consultancy business plan template and dynamic application security testing business plan template, if your offering spans a broader security-services scope than BAS alone.

For a BAS-specific plan, we also build out a dedicated compliance roadmap appendix mapping your CREST Pathway or SOC 2 readiness milestones against a 12-month timeline, and a vendor-comparison worksheet summarising licensing costs and contract terms across the commercial platforms named in this guide, so you can make an informed build-vs-buy decision before committing capital to a platform licence.

5 Mistakes First-Time Founders Make

• Positioning as a pure software reseller. Enterprise security buyers can tell within one call whether they're talking to an in-house red-team practitioner or a licence reseller with no validation expertise, the latter loses on price every time.
• Pricing against one-off pentests instead of ongoing retainers. BAS is sold as a continuous control-validation service. Anchoring your price to a single pentest quote undersells the recurring value and caps your revenue ceiling.
• Skipping CREST/ISO alignment in the UK. Losing enterprise and public-sector procurement purely on accreditation grounds is one of the most common, and most avoidable, reasons a technically strong UK practice fails to scale past its first few clients.
• Delivering raw simulation output with no risk narrative. A spreadsheet of ATT&CK technique IDs means little to a board. The businesses that retain clients are the ones translating that output into a plain-language risk story each quarter.
• Underestimating the sales cycle in cash-flow planning. Enterprise deals in this space commonly take 3-9 months to close. Founders who plan working capital around a 60-day sales cycle run out of runway before their first annual renewal lands.

A sixth pattern worth naming separately because it's less obvious: hiring too fast against pipeline rather than signed revenue. Because enterprise sales cycles are long and somewhat unpredictable, a founder who hires a second or third analyst against a strong pipeline of "likely" deals, rather than signed retainer contracts, frequently ends up carrying salary cost for 2-4 months before the revenue to support it lands, if it lands at all. The safer sequencing (reflected in the worked example above) is to hire the next analyst only once utilisation on the existing team consistently exceeds 80-85% of capacity across signed clients, not forecasted ones.

Frequently Asked Questions