The Investor Pitch for an OT Security Firm

Most business plan guides start with the market. Investors in this sector start somewhere else: they want to know why a plant manager would let your people near a live process network, and what happens to your revenue if one of your engineers trips a safety system. A plan for an industrial control systems security company is a trust document first and a forecast second. Get the pitch paragraph right and the rest of the plan has a reader who keeps going.

Below is the single-paragraph pitch we draft for clients before any financial modelling begins. Fill the brackets with your own numbers, then check that every bracket can be defended with a line item further down the plan.

What Investors Actually Score

Venture and angel investors who back industrial cyber companies have a reference set in mind. Dragos closed a $200 million Series D at a reported $1.7 billion valuation, which took its total funding to $340 million, according to SDxCentral. Claroty raised a $400 million Series E with participation from SoftBank, Bessemer Venture Partners and Schneider Electric, per CB Insights Research. Nozomi Networks raised $100 million from investors including Mitsubishi Electric and Schneider Electric, as reported by Nasdaq. You will not raise at those scales, but the pattern teaches three things about how you will be assessed.

• Strategic capital follows industrial credibility. Schneider Electric and Mitsubishi Electric sit in cap tables because their customers ask them about OT security. A boutique with a signed integration partner from a control-system vendor looks safer to a seed investor than one with a clever product and no channel.
• Recurring revenue is the valuation lever. Investors discount one-off assessment revenue heavily. Show assessments as the door-opener and managed monitoring, retainer advisory or compliance-as-a-service as the annuity. State the percentage of year-three revenue that recurs.
• Founder-market fit carries more weight than a deck. A founder who has commissioned a PLC, written a ladder-logic routine or sat through a NERC CIP audit is believed. A founder whose background is IT penetration testing has to explain the gap.

Seed cheques into a services-led OT security firm are typically smaller and slower than software rounds, so the plan should show a path that does not depend on a single large raise. The funding routes section later in this guide lays out how a blended structure of founder capital, an angel round and an SBA 7(a) or UK Start Up Loan can cover a launch without giving away more than 20 to 25 percent of the company.

Questions a Seed Investor Will Ask in the First Meeting

1. Which two named customers, or named design partners, will sign a paid pilot in the next 90 days?
2. What is your safety record, and which engineers have worked on live production networks without an incident?
3. What share of year-two revenue comes from a single customer, and what is your contractual protection if that customer leaves?
4. How many engineers can you hire at the salary you have modelled, given that the US median pay for information security analysts was $124,910 in May 2024, per figures reported by Coursera from BLS data, and OT-capable engineers command a premium over that?
5. If a customer suffers an incident while you hold their access, what does your professional indemnity and cyber cover pay, and does it exclude physical damage?

Answer these inside the plan, not in a follow-up email. The business plan writer service exists for founders who want a second pair of eyes on exactly this section before it goes to investors.

Market Size, Threat Data and Who Is Funded

Anyone quoting a single number for the ICS security market is picking one analyst firm's definition and ignoring the rest. Published estimates for the 2025 market range from roughly $15.4 billion to $23.2 billion across the main research houses, according to a MarketsandMarkets report and the other publishers indexed alongside it, including Straits Research, Persistence Market Research and SNS Insider. Forward projections are just as scattered: one release forecasts $43.77 billion by 2034 at an 8.03 percent CAGR, while another puts the figure at $20.50 billion by 2033. A twofold gap between forecasts is normal when one publisher counts software only and another bundles hardware, managed services and consulting.

Why a Bottom-Up Count Beats a Market Report

A lender or investor will accept a top-down number only as context. What they test is whether you can name how many buyers you can reach and what each pays. A worked example for a regional firm: suppose you target discrete and process manufacturers with 100 to 1,000 employees within a four-hour drive of Pittsburgh, Pennsylvania. If a county-level count of industrial plants gives you 400 candidate sites, 15 percent of them buy an assessment in any twelve-month window, and the average first engagement is $35,000, then the annual serviceable revenue in that region is $2.1 million. That is a number you can win a slice of with three engineers. It is also a number that shows why a single-region boutique tops out at roughly $2.5 million to $3 million before it must either add regions or add a recurring product.

The Threat Data That Drives Purchasing

The strongest demand signal is not a market report but incident data. Dragos reports that it tracked 119 ransomware groups affecting 3,300 industrial organisations in 2025, a 49 percent increase from 80 groups the year before, and that manufacturing accounted for more than two-thirds of the victims, according to its 2026 Year in Review press release. The same release states that organisations with comprehensive OT visibility contained incidents in an average of 5 days against an industry average of 42 days. Use that gap in your plan. It converts an abstract security promise into a downtime figure a plant finance director understands: 37 fewer days of disruption.

The full Dragos report also notes that organisations routinely misclassify incidents as IT-only and miss downstream effects on production and safety systems. That misclassification is your sales opening. A mid-sized manufacturer that was hit last year and restored its email servers in a weekend may not realise its production line went down because a historian server shared a domain with the office network.

Who Already Occupies the Space

Three well-funded product companies dominate the conversation: Dragos, Claroty and Nozomi Networks, with Armis and others competing at the asset-visibility layer. Their funding is covered above. Their strategic implication for a new entrant is clear. They sell platforms to large enterprises and utilities, and they depend on integrators and managed service providers to reach the rest. Nozomi and Claroty both list Schneider Electric among their backers, which tells you the control-system vendors want OT security partners in their channel.

The gap a services-led startup can fill sits below the enterprise tier. Plants with two to ten facilities, a lean engineering group and no dedicated OT security staff typically cannot justify a seven-figure platform deployment. They can justify a fixed-fee assessment, a scoped sensor deployment from a vendor through you as the integrator, and a monthly retainer for someone to read the alerts. Your competitor set in this tier is regional systems integrators adding a security line, Big Four advisory teams who price out of the segment, and engineering consultancies with a single OT security practitioner.

For standards, the reference most buyers quote is NIST SP 800-82. Revision 2 of that publication was withdrawn on 28 September 2023, so any plan that cites it as current signals stale knowledge. Cite Revision 3, and map your service catalogue to IEC 62443 zones and conduits, which procurement teams in Europe and increasingly in the US ask for by name. The SANS ICS business guide is a useful companion for framing the internal business case your customers will need to write.

Where Demand Concentrates Geographically

• Houston and the Gulf Coast, Texas: refining, petrochemicals and LNG terminals, with long-standing process safety culture and large OT estates.
• Pittsburgh and the Ohio Valley, Pennsylvania: steel, specialty metals and a growing robotics cluster, with many mid-sized plants lacking internal security staff.
• Greater Detroit and Michigan: automotive tier-one and tier-two suppliers under pressure from OEM cybersecurity clauses.
• Aberdeen and Teesside, United Kingdom: offshore energy and process industry sites covered by the UK NIS Regulations.
• Rotterdam and the Ruhr, Europe: port logistics and chemical plants preparing for NIS2 obligations.

Launch Budget and Funding Routes

The v5-era estimates for this keyword borrowed a factory cost model, with raw-material inventory and production-line equipment. An ICS security firm owns neither. Its capital goes into people, a physical test lab, tooling, insurance, certifications and the cash runway needed to survive a sales cycle that regularly runs six to twelve months. The Avvale planning range for a two-engineer, services-led launch is $145,000 to $429,000 (£115,000 to £339,000), and the spread is almost entirely explained by how many months of payroll you fund before the first retainer lands.

Line-by-Line Cost Breakdown

• Payroll runway (3 to 6 months for two engineers plus founder draw): $60K–$150K (£47K–£118K). Loaded cost of an OT-capable engineer in the US typically runs $150K to $190K a year once benefits and payroll tax are added. This is the number lenders scrutinise first.
• Physical test lab: $30K–$90K (£24K–£71K). A bench with representative controllers from Rockwell Automation (ControlLogix or CompactLogix), Siemens (S7-1500), Schneider Electric (Modicon M580) and a managed industrial switch, plus HMI software licences. You cannot credibly test attack paths or write detection content without hardware that behaves like a plant.
• Certifications and training: $15K–$55K (£12K–£43K). Covers SANS ICS courses and GIAC credentials such as GICSP and GRID for engineers, ISO 27001 for the company, and an IEC 62443-2-4 service-provider assessment if you target integrator-style engagements. SANS course seats list in the high single-digit thousands of dollars each, so two engineers on two courses consumes a quarter of this line.
• Tooling and software licences: $12K–$45K (£9K–£35K). Wireshark, Zeek and Suricata are free. Commercial passive-monitoring platforms from Nozomi Networks, Claroty or Dragos are usually obtained through partnership terms, not bought outright, so budget demonstration licences, a vulnerability management tool with OT plugins such as Tenable OT Security, and a ticketing and documentation stack.
• Insurance: $12K–$36K (£9K–£28K). Professional indemnity (technology errors and omissions), cyber liability and general liability. Read the policy for exclusions on physical damage and bodily injury; many OT customers will ask for proof of cover above $2 million before they sign.
• Legal and incorporation: $6K–$18K (£5K–£14K). Master services agreement, statement-of-work templates, mutual NDAs, a limitation-of-liability clause reviewed by counsel who has seen OT contracts, and, in the UK, Companies House registration.
• Marketing, events and travel: $10K–$35K (£8K–£28K). Industrial buyers meet at trade events. S4 in Miami, the DEF CON ICS Village and regional ISA sections are inexpensive places to be seen by the right engineers; large exhibition stands are not.

Funding Routes That Fit a Services-Led Launch

US route. The SBA 7(a) loan programme can fund working capital and equipment for a professional services firm, with a maximum loan of $5 million, but lenders will want collateral, a personal guarantee and a credible repayment history in your forecast. A pre-revenue cyber consultancy rarely clears underwriting alone. The more realistic structure is a $100,000 to $150,000 SBA 7(a) loan secured against personal assets or a lab equipment schedule, paired with $250,000 to $300,000 from angels who understand the sector. Equipment financing for the test lab is a second option, since the hardware has resale value that payroll does not.

UK route. The government-backed Start Up Loans scheme lends up to £25,000 at a fixed 6 percent, usually alongside a mentor, which covers lab hardware and insurance but not payroll. Founders typically combine it with SEIS and EIS investor money: the Seed Enterprise Investment Scheme gives investors 50 percent income tax relief on qualifying shares, which makes angel conversations easier for early rounds. Innovate UK and Cyber Runway-style programmes also exist for product-led plays. For a services-led firm, SEIS-eligible equity plus a Start Up Loan is the cleanest route to the first £150,000.

Customer-funded route. OT security is one of the few startup categories where a customer can fund the build. A paid pilot assessment at $25,000 to $40,000 from an industrial design partner brings in cash within 60 days and gives you the reference you need. Plan for one or two of these before you hire the second engineer.

For a deeper look at how to present the funding ask, the Research and Content package adds sourced market data and a narrative section to your own financial inputs.

Pricing, Utilisation and Unit Economics

ICS security firms earn from four revenue lines. Fixed-scope assessments and penetration tests are the entry product. Time-and-materials advisory covers programme design, standards mapping and incident-response retainers. Managed monitoring and detection retainers produce the recurring revenue. Reselling or integrating a vendor platform adds implementation fees and, in some partner agreements, a margin on licences.

What Buyers Pay

General penetration testing starts at an average base cost between $10,000 and $45,000, and security consulting hourly rates run from about $200 to $500, according to Blaze Infosec's pricing guide. OT work commands the upper end because of the specialist skill and the risk of working near live processes; the same guide notes that providers mostly quote OT and ICS scopes individually rather than at a published per-site price. Use these planning prices, and label them as assumptions in your plan:

• OT security assessment, single site: $18,000 to $60,000, depending on asset count, number of Purdue levels in scope and whether a passive network capture is included.
• Segmentation and architecture design project: $40,000 to $150,000.
• IEC 62443 gap assessment for a product manufacturer: $25,000 to $90,000.
• Managed OT monitoring retainer: $4,000 to $12,000 per month per site.
• Incident-response retainer: $30,000 to $120,000 a year, with prepaid hours.

Worked Unit Economics for a Three-Person Team

A founder and two engineers, working from a rented unit with a lab bench near Pittsburgh, bill 700 hours (founder) and 1,000 hours each (engineers) in year one. Available hours per head are about 1,650 after leave and training, so utilisation is 42 percent for the founder and 61 percent for the engineers. At a blended rate of $250 per hour that is 2,700 hours and $675,000 of project revenue. Two managed monitoring retainers begin in the second half at $6,000 per month each, adding $72,000, for a year-one revenue of $747,000.

Costs: engineer payroll of $340,000 loaded, a founder salary of $120,000, part-time operations support at $45,000, lab, tooling, insurance and certifications at $110,000, subcontractors and travel at $95,000. Total $710,000, which leaves a net profit of about $37,000, or 5 percent. Year two, with a third engineer, six retainers and a 70 percent utilisation target, the model reaches $1.62 million and a 14 percent net margin. Year three, with seven staff and 14 retainers generating $1.0 million a year, reaches $2.9 million and 19 percent.

The numbers show two things lenders care about. Year one is thin, so cash buffers matter. And the margin step comes from retainers, since a retainer's gross margin of 50 to 60 percent exceeds the 35 to 45 percent typical of project work after subcontractor and travel costs. The sales plan should therefore track retainer conversion from assessment as its key metric.

Margins by Revenue Line

These are Avvale planning ranges built from consulting-firm benchmarks. Replace them with your own quotes once you have two or three real proposals out.

The sales cycle deserves its own paragraph in the plan. Industrial buyers procure through engineering, operations, IT and sometimes legal, and they schedule work around planned outages. A proposal sent in October for a plant that shuts down in June will wait until June. Model your pipeline with realistic delay, and show a 90-day cash buffer for slips.

Three Ways to Build the Company

The same keyword covers three quite different businesses. They differ in capital needs, margin, time to first revenue and what investors will pay for them. Choose one in the plan and explain why. Mixing all three in year one is the most common reason plans read as unfocused.

For most founders reading a template at this price, the assessment boutique is the right first step. It needs the least capital, proves demand quickly and builds the customer relationships a managed service needs. A plan that begins as a boutique and shows a dated trigger for adding monitoring, such as the sixth completed assessment or a signed partner agreement, reads as credible. A plan that begins as a software product needs the deeper technical and financial scrutiny of the bespoke plan service, because investors will test product architecture, patents and the founding team's track record against the incumbents.

Related reading for adjacent plans: the aviation cyber security business plan template covers a regulated vertical with its own certification path, and the 5G industrial IoT business plan template covers the connectivity layer many OT networks are moving to.

Regulation: NERC CIP, NIS2, UK NIS and IEC 62443

You do not need a licence to open an ICS security consultancy in the US or UK. What you need is a command of the regulation your customers live under, because that is what produces their budget. Regulation also sets limits on what you may do: a firm that touches Bulk Electric System networks, defence supply chains or UK critical national infrastructure meets contractual obligations the plan should price in.

United States

• NERC CIP standards (FERC-approved): mandatory cybersecurity requirements for owners and operators of the Bulk Electric System. NERC enforcement can reach approximately $1.58 million per violation per day, a figure cited in compliance overviews such as the Dragos OT compliance guide. Utilities buy NERC CIP gap assessments, evidence preparation and audit support; those engagements pay well and demand engineers who understand the standards line by line.
• TSA pipeline security directives and CISA programmes: pipeline operators work under TSA security directives; CISA publishes advisories and free tools that your customers will already have seen. Reference them and show how your service goes beyond them.
• CIRCIA incident reporting: the Cyber Incident Reporting for Critical Infrastructure Act requires covered entities to report significant incidents, with the final rule timeline subject to change. Check CISA's current position before you finalise the plan.
• State business registration and professional liability: an LLC or C-corporation, an EIN, and a state business licence. Some states have no professional licence requirement for security consulting, but a few require private investigator licensing for certain digital forensic work, so check where your incident-response work sits.
• Defence supply chain clauses: firms serving defence contractors meet DFARS and CMMC expectations on their own systems, since customers will audit their suppliers.

United Kingdom

• NIS Regulations 2018: baseline security and incident reporting duties for operators of essential services in energy, transport, water, health and digital infrastructure, enforced by sector regulators such as Ofgem.
• Cyber Security and Resilience Bill: the government's bill would place the NCSC Cyber Assessment Framework on a statutory footing, add 24-hour incident notification and set a higher maximum fine of £17 million or 4 percent of turnover, with a standard maximum of £10 million or 2 percent, as summarised by Legal 500. Plan to sell CAF gap assessments to operators ahead of that bill's passage.
• CREST membership and CHECK status: buyers in government and critical infrastructure often ask for CREST-accredited testers, and CHECK is the NCSC scheme for testing government systems. Both take months to obtain; budget for the fees and the exam costs.
• Cyber Essentials Plus and ISO 27001: your own certifications, which customers request at procurement.
• Companies House, UK GDPR and ICO registration: standard for any limited company handling client data.

European Union and International

• NIS2 Directive: essential entities face fines of up to €10 million or 2 percent of global turnover and important entities up to €7 million or 1.4 percent, as described by Industrial Defender. IEC 62443 is widely presented as the practical way to demonstrate Article 21 compliance in industrial settings, a point made in this Shieldworkz guide.
• IEC 62443: the international standard series for industrial automation and control system security. It has no enforcement power by itself; it bites through contracts that demand adherence, which is why plant owners ask integrators and product makers for conformity evidence.
• Gulf region: national cyber authorities in Saudi Arabia and the UAE issue operational technology controls for energy and utilities, and local presence or a registered partner is usually required to bid.

A useful way to present this section in your plan: a three-column table of regulation, who is bound, and which of your services it triggers. Lenders see a revenue map, not a legal list.

Six Mistakes That Stall New ICS Security Firms

These are patterns we see when reviewing plans and early-stage companies in this sector. Each one shows up in the financials eventually, so the plan should show you have priced it in.

1. Running IT scanning habits on live control networks

An active vulnerability scan that is routine on an office network can crash an older PLC or a serial-to-Ethernet gateway. Firms that learn this on a customer's production line lose the customer and sometimes their insurance. Your plan should describe passive-first methodology, a test-in-lab-before-production rule and a written change-control step with the plant's operations lead. State it as a company policy, with the cost of the lab that makes it possible.

2. Selling to the IT security lead instead of the plant

The CISO often owns the budget request but not the process. The plant manager, the controls engineering lead and the EHS manager decide whether you get access. A plan that shows only CISO-targeted outreach will have a longer cycle than it admits. Map the buying group in the plan: who signs, who vetoes, who benefits.

3. Treating a withdrawn or old standard as current

NIST SP 800-82 Revision 2 was withdrawn on 28 September 2023, and customers who read current guidance will notice a proposal that cites it. The same applies to references to the older IEC 62443 part numbers or to NERC CIP versions that have been superseded. Put one named person in charge of standards currency and show a quarterly review in the operations section.

4. Underpricing the first three engagements

Founders discount to win references, then discover that the reference customer anchors every later quote. General security consulting rates already run $200 to $500 an hour, per the Blaze Infosec guide, and OT work warrants the upper half. If you must discount, trade it for something countable: a written case study, a logo, a referral to two named peers.

5. Ignoring limitation of liability and insurance exclusions

A single assessment that triggers a plant shutdown can generate a claim far above the engagement fee. Without a limitation-of-liability clause capped at a multiple of fees, and an insurance policy that covers physical and consequential damage, one claim can end the company. Show the clause and the cover amount in the risk section.

6. Hiring only offensive talent

A team of penetration testers can find vulnerabilities, but customers are also buying network architecture, change management, safety understanding and documentation. Plan at least one hire from a controls or process engineering background. The median US pay for information security analysts of $124,910 understates what an engineer with both control systems and security skills will ask; build a 20 to 40 percent premium into your payroll line for those hires.

Sample Plan Extract

The extract below shows the layout of a plan for a UK-based practice. The company is a composite, and every figure is an illustration that follows the model in the unit economics section above.

What Is in the Template

Each Avvale template is pre-structured for the way the industry is financed and sold. For an ICS security firm, the sections work as follows:

• Executive Summary: the pitch paragraph above, plus the funding ask and use of funds, written to be read in 60 seconds.
• Company Overview: legal structure, founders' industrial credentials, insurance cover, and the lab location.
• Industry Analysis: bottom-up site counts, incident data from sources such as Dragos, and the regulation that creates your customers' budget.
• Customer Analysis: the buying group at a plant, the sales cycle and the trigger events (an incident, an audit, a customer clause).
• Competitor Analysis: platform vendors, integrators, advisory firms and where a boutique wins.
• Services and Pricing: assessment, architecture, compliance and retainer packages with the price ladder.
• Operations Plan: methodology, safety rules, lab, change control, and engineer hiring plan.
• Management Team: founder bios, advisory board and the credentials customers look for.

The optional Financial Forecast add-on (included in our $300/£250 and $1,000/£800 packages) provides a 5-year Excel model with income statement, cash flow, balance sheet, break-even analysis, and startup capital requirements. For this sector the model includes a utilisation sheet and a retainer-conversion tracker.

If you would rather start from the structure used by other firms that have raised money, the free business plan template hub lists every sector version we publish.

Frequently Asked Questions

Useful Links & Resources

• Facebook
• Instagram
• LinkedIn
• YouTube