Freelance Cyber Security Consultant Guide

Going freelance in cyber security changes the job less than it changes the risk: you carry the tax status, the liability and the client's legal authorisation yourself, and a mistake in any of them can cost more than a month of fees. Employed consultants have a legal team, a finance function and a firm's insurance behind every engagement. A freelancer has a contract, a business structure and whatever cover they bought. This guide covers the self-employment mechanics for security work: choosing a structure, IR35 and employment status, setting a day rate, contracts and authorisation for testing, insurance, data protection duties and finding work. The tax detail is UK-centred because IR35 is a UK rule, with notes for the United States; the commercial and legal points apply widely. It is for experienced practitioners thinking about contracting or independent consultancy, and for managers who engage them.

Status on 13 November 2026: UK tax, IR35 and Making Tax Digital rules described here reflect HMRC guidance read on that date and change often. This guide is not legal, tax or financial advice; check GOV.UK or a qualified adviser for your situation.

Key takeaways

Status is decided contract by contract. Under the UK off-payroll rules, a medium or large client decides whether each engagement is inside IR35 and must give you a status determination statement with its reasons.
Price for billable days, not calendar days. Bench time, holidays, training, sales and admin all come out of the same rate, so the day rate is a business calculation, not an annual salary divided by 220.
Authorisation is your legal shield. For testing work, written authorisation from someone entitled to give it, a defined scope and rules of engagement are what separate a penetration test from unauthorised access.
Insurance is a contract requirement, not an optional extra. Professional indemnity and public liability cover are commonly required before work starts, and cyber cover protects your own systems holding client data.
You become a data controller. Holding client findings, credentials and personal data makes you responsible for securing them, and in the UK usually means paying the ICO data protection fee.

Employed consultant, contractor or independent consultant

The role itself, and the skills clients test, are covered in the Security Consultant Career Guide. Freelance work comes in three commercial shapes, and each has different tax and liability consequences.

Model	How work arrives	Typical engagement	Status exposure	Who carries delivery risk
Contractor through an agency	Recruitment agency places you on a client project	Months, often extended; day rate; embedded in a client team	Highest: long, integrated roles under client direction often fall inside IR35	Mostly the client
Contractor direct to client	You contract directly, often after a referral	Defined project or capacity role	Depends on control, substitution and how the work is run	Shared
Independent consultant (outcome-based)	You sell a defined service: test, assessment, policy set, incident readiness	Fixed scope, fixed or day-rate price, your methods	Lower where you control how, when and where the work is done	You, through warranties and liability caps
Associate of a consultancy	A firm subcontracts you under its brand and contract	Firm's client engagements	The firm's client size and contract terms decide	The firm towards the client, you towards the firm

Many freelancers mix models: an associate arrangement for steady work and direct engagements for higher-value advisory. Be aware that scheme-based testing for the UK public sector runs through companies, not individuals: NCSC describes CHECK as the scheme under which NCSC assured companies conduct authorised penetration tests of public sector and critical national infrastructure systems. Freelance testers usually reach that work as associates of a CHECK company.

Choosing a business structure

GOV.UK sets out the main UK options. The choice affects liability, tax and how clients see you.

Factor	Sole trader	Limited company (personal service company)	Umbrella company
Liability	Unlimited: you are personally responsible for business debts	Limited to your investment in the company, though contracts can still name you and insurance is still needed	You are an employee of the umbrella
Setup	Register for Self Assessment once self-employment income passes £1,000 in a tax year	Register with Companies House before trading; file accounts and Corporation Tax returns	Sign up with the umbrella; it runs payroll
Tax on profits	Income Tax and National Insurance on profits	Corporation Tax: 19% on profits of £50,000 or less, 25% above £250,000, marginal relief between; then tax on salary and dividends you draw	PAYE through the umbrella's payroll
IR35	Off-payroll rules apply to intermediaries, not to sole traders contracting directly	Off-payroll rules apply contract by contract	HMRC says the rules are unlikely to apply
Client acceptance	Fine for small direct clients; some agencies and large clients will not contract with sole traders	Widely accepted by agencies and enterprises	Common for inside-IR35 agency roles

Practical points: from 6 April 2026 Making Tax Digital for Income Tax applies to sole traders with qualifying income above £50,000, so choose accounting software that supports it. Whatever the structure, keep business and personal money separate, and take advice from an accountant who works with contractors before signing your first contract.

VAT: you must register if taxable turnover in the last 12 months goes over £90,000 (within 30 days of the end of the month you crossed it), or if you expect to go over it in the next 30 days alone, for example on signing one large contract. Many freelancers reach the threshold in their first year at full utilisation, so track it monthly.

IR35 and employment status

The off-payroll working rules exist so that someone working like an employee through an intermediary pays broadly the same Income Tax and National Insurance as an employee. Since 6 April 2021, the client usually decides whether the rules apply. If a worker provides services to a small client outside the public sector, the worker's intermediary decides instead.

How a determination works

Client assesses each contract. The client considers how the engagement actually runs and issues a status determination statement (SDS) giving its reasons.
CEST is the usual tool. HMRC's Check Employment Status for Tax tool asks about the contract, your responsibilities, who decides what work is done and when, where and how it is done, how you are paid and whether you get benefits or expenses. HMRC says it will stand by the result as long as the information given is accurate, and a saved result can serve as a valid SDS.
Inside IR35: the deemed employer (the client, or the agency paying you) deducts Income Tax and employee National Insurance from fees and pays employer National Insurance and Apprenticeship Levy to HMRC.
Outside IR35: your company is paid gross and handles its own tax.

Status factors in security work

Factor	Points towards outside	Points towards inside
Control of how	You choose testing methodology, tools and order of work within an agreed scope	Client manager assigns tasks daily, sets hours and reviews how you work
Deliverable	Defined outputs: a test report, a gap assessment, a policy set	Open-ended capacity: "security engineer for six months"
Substitution	A genuine, usable right to send a suitably qualified substitute (clearance permitting)	Only you personally may do the work
Integration	Separate tools and accounts, no line management of staff, not in the client's org chart	Client laptop, staff badge, on-call rota, managing employees
Financial risk	Fixed price, unpaid rework for your own defects, your own equipment and insurance	Paid for time regardless of outcome, all costs reimbursed

Security work raises a specific tension: clearance requirements and named-tester rules can limit substitution, and embedded security operations roles look like employment. Keep evidence of how each engagement actually runs (statements of work, change requests, your own equipment), because the reality of the working arrangement matters, not only the contract wording.

Outside the UK

In the United States, the IRS weighs evidence in three categories: behavioural control, financial control and the type of relationship. No single factor decides it. Either party can ask the IRS for a determination on Form SS-8, which can take at least six months. Other countries have their own tests; check the tax authority's guidance in the country where the client and you are based.

Setting a day rate

A day rate has to fund the year, not the day. Work it out from the bottom up, then sense-check it against what clients pay for the same specialism through agencies and consultancies.

Input	What to include
Target income	What you want to pay yourself, including pension contributions an employer would have made
Business costs	Insurance, accountant, laptops and test equipment, licences for commercial tools, lab cloud costs, certifications and renewals, training, travel not recharged, professional memberships
Billable days	Working days minus holidays, public holidays, sickness, training, business development and admin, then a utilisation factor for gaps between contracts
Risk margin	Late payment, bad debt and a first-year buffer while you build a pipeline

Formula: day rate = (target income + business costs + risk margin) ÷ expected billable days. An illustrative example with round numbers: 252 working days, less 25 holiday, 8 public holiday, 10 training and 15 sales and admin leaves 194; at 75% utilisation that is about 145 billable days. Planning on 220 billable days instead would understate the rate needed by roughly a third.

What moves the rate: niche skills in short supply (OT, cloud identity, AI security testing), clearance, scheme membership through an associate firm, outcome-based pricing that includes report writing and retesting, and direct relationships that cut out agency margin. Inside-IR35 engagements need a higher gross rate to reach the same net income, so ask for status before quoting. Fixed-price work should include a scoping allowance and a change-request mechanism; the Penetration Test Scoping Checklist is a good template for what to pin down.

Contracts and authorisation

Security work involves access a client would not give anyone else, so the contract carries more weight than in most freelance trades.

Master agreement and statement of work: separate the standing terms (liability, confidentiality, IP, payment) from each engagement's scope, deliverables, dates and price.
Written authorisation: for any testing, get signed authorisation from a person entitled to give it for every system in scope, including third-party hosting and cloud providers whose terms require notice. Computer misuse laws generally turn on authorisation; see the Computer Misuse and Anti-Hacking Laws Guide.
Rules of engagement: testing windows, excluded systems and techniques, emergency contacts, stop conditions and how to report a critical finding mid-test.
Liability cap: limit liability to a multiple of fees or to your insurance cover, and exclude indirect and consequential losses where the law allows. Expect large clients to push back; know your floor before you negotiate.
Data handling: where you process personal data for the client, UK GDPR Article 28 requires a written processor contract covering instructions, confidentiality, security, sub-processors, deletion or return at the end, and audit.
Intellectual property: clients own deliverables; you keep pre-existing tools, scripts and methods, licensed for the client's use.
Payment terms: invoice frequency, days to pay and late payment interest. Agencies may pay on timesheet approval, so chase approvals weekly.
Non-solicitation and conflicts: read restrictive clauses that could stop you working for the client's competitors or for the end client directly after an agency placement.

Insurance

Cover	What it responds to	Who usually asks for it
Professional indemnity	Claims that your advice or work was negligent and caused the client a loss, for example a missed finding or an outage during testing	Almost every direct client and agency; amount stated in the contract
Public liability	Injury or property damage at client premises	Clients where you work on site
Employers' liability	Claims from employees; UK limited companies with employees generally need it	Required by law in many cases once you employ people
Cyber insurance	Incidents affecting your own systems, including loss of client data you hold	Increasingly requested by clients handling sensitive data
Contract-specific cover	Tax investigation cover, business equipment, income protection	Your own choice

Check that professional indemnity covers the activities you actually perform (testing, red teaming, incident response and advisory may be priced differently), the territories you work in and any run-off cover after you stop trading. The Cyber Insurance Guide explains cyber policy structure and common exclusions.

Running a secure one-person practice

Clients will ask you security questionnaires, and you hold their most sensitive data: vulnerability reports, network diagrams, sometimes credentials. Treat your practice as a small regulated business.

Data protection fee: the ICO states that organisations, including sole traders, that use personal information need to pay a data protection fee under the Data Protection (Charges and Information) Regulations 2018 unless exempt. Check whether you qualify for an exemption on the ICO site.
Separate identities: separate devices or virtual machines per client where contracts require it, separate accounts with MFA, no reuse of client credentials, and credentials removed at engagement end. Clients should manage you through their contractor identity process; the Contractor Identity Lifecycle Guide shows what good clients will expect.
Evidence and report handling: encrypted storage, defined retention, secure transfer and documented deletion when the contract ends.
Baseline certification: a recognised baseline for your own business (in the UK, Cyber Essentials is commonly asked for in public sector supply chains) answers many questionnaire items in one go.
Tooling licences: confirm commercial tool licences permit use on client engagements, and that free tool licences permit commercial use.

Finding and keeping work

Before leaving employment: build six months of costs in savings, line up the first engagement, check your current contract for restrictive covenants, and agree the business structure with an accountant.
Choose a specialism to sell: buyers hire a freelancer for a specific outcome. A narrow, credible offer (identity and access reviews, cloud security assessments, OT testing, ISO 27001 implementation) is easier to buy than "security consultancy".
Use three channels: agencies for volume, associate arrangements with consultancies for steady project work, and direct relationships for the highest margin. Referrals from former colleagues are usually the first source of direct work.
Show credibility: certifications that clients name in tenders (see the Cybersecurity Certifications Guide), professional registration with the UK Cyber Security Council, published talks or research, and anonymised sample deliverables.
Plan the next contract during the current one: start conversations six to eight weeks before an engagement ends to reduce bench time.

Small vs large clients: small clients usually want fixed-price outcomes, accept simpler contracts and leave IR35 assessment to you. Large enterprises and public bodies bring procurement frameworks, higher insurance requirements, security vetting and their own status determinations, but also longer engagements.

Measuring the business

Track a few numbers monthly so problems show up before cash runs out:

Utilisation: billable days as a share of available days, against the figure your rate assumes.
Pipeline cover: weeks of contracted work ahead.
Debtor days: average days from invoice to payment.
Client concentration: share of revenue from the largest client; heavy dependence on one client is a commercial risk and can also be a sign of an employment-like relationship.
Effective day rate: revenue divided by all days worked, including unbilled scoping and rework.
Rolling VAT turnover: the last 12 months against the registration threshold.

Common failure patterns

Testing on verbal approval: starting work before signed authorisation arrives, or testing a cloud or hosted asset the client did not have the right to authorise.
Accepting an inside determination without reading it: not asking the client to explain its SDS, or not raising facts that would change the outcome.
Pricing like a salary: using an employed salary divided by working days, then running out of cash during the first gap between contracts.
Unlimited liability: signing a client's standard terms with uncapped liability for a test that could cause an outage.
Client data on a personal laptop: reports and credential dumps kept indefinitely on unmanaged devices, with no deletion at contract end.
Insurance that does not match the work: professional indemnity bought for advisory work while you sell penetration testing.

Practitioner checklist

Choose a structure (sole trader, limited company or umbrella) with an accountant, and register before trading.
Calculate your day rate from billable days, costs and risk margin, not from a salary.
Ask for status before quoting, and read every status determination statement and its reasons.
Use a master agreement and a statement of work with a liability cap and clear IP terms.
Get signed authorisation and rules of engagement before any testing begins.
Buy professional indemnity, public liability and cyber cover that match the services you sell.
Pay the ICO data protection fee unless exempt, and put Article 28 terms in place where you process client personal data.
Secure your own practice: MFA, encrypted storage, per-client separation and documented deletion.
Track utilisation, pipeline, debtor days and rolling VAT turnover monthly.

Freelance Cyber Security Consultant Guide: Contracting, Day Rates, Insurance and IR35