Latest / The Side Hustle Career Podcast with Fexingo: Second Income, Freelancing While Employed / How a Cybersecurity Analyst Built a 25K Side Hustle in VAPT
Transcript
- Lucas: So, Luna, I've been digging into a side hustle that feels like it's straight out of a spy movie, but it's actually a very real, very lucrative niche: vulnerability assessment and penetration testing. VAPT for short. Luna: Okay, that does sound cool. But isn't that something you need a whole lab and a security clearance for? Lucas: Not necessarily. I talked to Marcus, a cybersecurity analyst who works a full-time job during the day. On the side, he runs a VAPT consultancy that's pulling in about twenty-five thousand dollars a month. That's not a typo. Luna: Twenty-five thousand a month? That's serious money. How does he do it without burning out or, you know, getting fired? Lucas: That's exactly the question I asked. And his answer was surprisingly simple: he focuses on small and medium businesses that can't afford a full-time security team. They know they need to be compliant, but they don't have the budget for a big firm. Luna: So he's basically the affordable security guy for the little guys. How did he get his first client? Lucas: It wasn't a fancy marketing campaign. He started by reaching out to local businesses that had just been mentioned in a data breach report. He offered a free initial consultation and a sample report for one of their systems. Luna: A free sample report. That's a smart foot in the door. But isn't there a conflict of interest with his day job? Lucas: He was careful about that. He used his own equipment, his own software licenses, and he only took on clients in industries that didn't overlap with his employer's. He also checked his employment contract to make sure there was no non-compete that would bite him. Luna: So no moonlighting on the company laptop. That's a good rule. But the big question: how does he price these services? Lucas: He doesn't charge by the hour. He packages his work. For a small business, he'll do a vulnerability assessment and a penetration test for a flat fee, usually between five and ten thousand dollars depending on the size and complexity. Luna: And that includes a report, I assume. These businesses probably need that for insurance or compliance. Lucas: Exactly. The report is the product. He spends a week on the actual testing, then another week writing up the findings in plain English. That's what they're paying for—someone to tell them, 'Here's what's broken, here's how to fix it, and here's how to prevent it next time.' Luna: So the real value is in the communication, not just the hacking. That makes sense. But I'm curious about the ethics. Is it legal for him to do this on the side? Lucas: Totally legal, as long as he has written authorization from the client. He insists on a signed contract that defines the scope of the test. And he never touches systems without explicit permission. Luna: That's reassuring. But I bet some of his clients are a little nervous about letting someone poke around their systems. Lucas: They are. Which is why he spends a lot of time on the sales call, walking them through what he'll do and what he won't. He wants them to feel comfortable. That trust factor is huge in this niche. Luna: I can imagine. So, twenty-five thousand a month—how many clients is that? Like two or three? Lucas: He does about three to four engagements per month. Some are smaller, like a quick web app test for three grand. Others are bigger, like a full network assessment for twelve. It averages out. Luna: And that's all on top of a full-time job? I'm exhausted just thinking about it. Lucas: He says the key is batching. He does all his client work on weekends and a couple of evenings during the week. He's not constantly switching contexts. He blocks out time for deep work. Luna: That makes sense. But I have to ask—what about the certifications? Do you need a bunch of alphabet soup after your name to do this? Lucas: He says the two that matter are the OSCP, which is the Offensive Security Certified Professional, and the CEH, Certified Ethical Hacker. But he also says hands-on experience trumps certificates. He started by testing his own systems and then offered to test for friends and family. Luna: So a portfolio of practice work is more important than the certs. That's a relief for someone like me who doesn't have a security background. Lucas: Right. And speaking of background, you don't need to be a cybersecurity expert to apply this same model. The idea of packaging your expertise into a flat-fee service is transferable to almost any field. Luna: True. And I was thinking—if someone's listening and they're in a similar position, they might be wondering if they can handle the legal side. How does Marcus handle contracts and liability insurance? Lucas: He has a simple one-page contract he drafted with help from a lawyer friend. And he carries professional liability insurance, which is surprisingly affordable—a few hundred dollars a year for a solo consultant. Luna: That's smart. It probably pays for itself with the first client. So, Lucas, if today's episode helped you think about your own skills in a new way, that's exactly the kind of thing we love hearing. Lucas: And if it did, and you feel like supporting the show, there's a link where you can buy us a coffee. It's buy me a coffee dot com slash fexingo. Every little bit helps us keep the podcast going without ads. Luna: But no pressure. We're just glad you're here. Lucas: Anyway, back to Marcus. He also emphasized the importance of networking. He gets most of his clients through referrals from a local business association he joined early on. Luna: Referrals are huge. People trust their peers more than a cold email. So what's the biggest mistake people make when trying to start a side hustle like this? Lucas: He says it's underpricing. When you charge too little, clients don't take you seriously, and you end up working for peanuts. He started at two thousand per engagement and realized he was selling himself short. He doubled his prices and actually got more clients. Luna: That's a classic mistake. Charging more signals quality. So, any final advice for someone listening who's thinking, 'Maybe I could do something like this'? Lucas: Start small. Pick one skill you're really good at, package it as a service, and offer it to one or two people you know. Get feedback, refine, and then gradually raise your prices. And always, always keep your day job ethics in mind. Luna: Solid advice. And if you want to hear more about Marcus's journey, we'll link to his blog in the show notes. But for now, I think we've given everyone a lot to think about. Lucas: Definitely. Thanks for joining us, and we'll catch you next time on The Side Hustle Career Podcast.