Add cybersecurity to your services — without a security team
Your clients ask for penetration tests, SOC 2 and ISO 27001. With us, you can say yes. You sell, we deliver — under your brand or ours. You keep the client and earn on every project.
We become your cybersecurity department. If it suits you, you become our development, marketing or sales department.
Discuss a partnership| Founded by a CISSP. Trusted by DTEK, PrivatBank, Work.ua, NAKIVO, Astana International Exchange, and other customers across 30 countries. |
What you get as a partner
- A new revenue line. Penetration testing, compliance and vCISO become part of your offer. You earn a fee or your own margin on every project.
- Answers instead of lost deals. When your client’s auditor, investor or enterprise customer asks for a pentest report, ISO 27001 certificate or SOC 2 evidence, you don’t have to send them elsewhere.
- No hiring. Senior security engineers when you need them, without recruiting them or paying for idle time.
- Your client stays yours. NDA and non-solicitation by default. We never go around you.
Four ways to work together
Pick how much you want to do yourself.
| Refer | Resell | Under your brand | Your security practice | |
|---|---|---|---|---|
| Who signs with the client | We do | You do | You do | You do |
| Who talks to the client | We do | You lead; our experts join as H-X | Your choice: you alone, or our engineers as your team | Your team, with our support |
| Brand on the proposal and report | H-X | H-X | Yours | Yours |
| How you earn | 10% of what the client pays us | Your margin over our partner price | Your margin; you set the price | Your margin, plus your own services around it |
| Your effort | An introduction | Sales and account management | Sales, account management, your templates | A security line of business, built with us |
Many partners start with referrals and move to their own brand once requests come regularly. You can use different models for different clients. A bit more detail about them.
Tell us about a company that needs security, or introduce us by email. We qualify the request, prepare the proposal, sign the contract and deliver the project. You get 10% of what the clients pays us, for an unlimited period of time. We can agree on a different share, depending on your market. We pay after the client pays us, by bank transfer or in crypto.
No technical knowledge needed. Works for companies and individuals: consultants, agencies, accountants, recruiters — anyone whose clients build or run software.
Fits: everyone.
You sign the contract with the client and invoice them. We give you our partner price, and you add your margin. Our name stays on the proposal and the report, which often helps: an auditor or an enterprise customer may want the test done by an independent security firm, not by the team that built the software.
You lead the relationship; our engineers join scoping and report calls as H-X. For example, a compliance consultancy prepares a SaaS company for SOC 2 and resells our penetration test as the technical evidence.
Fits: software development companies, integrators, compliance consultancies.
We deliver penetration tests, compliance projects and vCISO as part of your team. Proposals and reports come in your template and under your name; ours appears nowhere. You choose how the client sees us:
- You talk to the client yourself. We work in the background and prepare you for every call.
- Our engineers join calls and correspondence as members of your team.
If your client ever contacts us directly, we send them back to you.
Fits: IT outsourcing and product development companies, MSPs, cloud and DevOps consultancies, digital agencies.
For partners who want cybersecurity to be a permanent part of their business, not a one-off project. We build it with you, step by step:
- A service catalogue, a partner price list, and proposal, report and policy templates under your brand.
- Sales training for your team: what to offer, how to qualify a request, how to answer typical objections.
- Presales support: our expert joins your client calls as part of your team.
- Delivery of every project you sell, from a single pentest to a long-term vCISO engagement.
- Your own specialists, if you want them: we help you hire, train and mentor them. Your team takes the work it is ready for; we take the rest.
Fits: IT integrators, MSPs and software companies with a stable client base, especially in markets with few local security specialists.
Swap departments: works with any model
We become your cybersecurity department; you become our development, DevOps, marketing, sales or recruiting department. We refer clients both ways, and referral fees go both ways too.
How your first project works
Shown for a project under your brand or a resale:
- Your client asks. For example: “Our enterprise customer wants a penetration test report before signing.” Send us what you know: the system, the deadline, the standard the client works to.
- We reply quickly. We ask what is missing and, if needed, hold a short scoping call — with you, or with the client as part of your team.
- You get a proposal at partner price. Scope, timeline and price, in your template if you work under your brand.
- You add your margin. You set the client price and send the proposal. We help you answer the client’s questions.
- Paperwork. Once: an NDA and a partner agreement, yours or ours. Per project: an order between you and us, and your own contract with the client. In a referral, the client signs with us, and the partner agreement fixes your fee.
- Delivery. One of our advantages for pentesting is a managed bug bounty program. Two our independent teams test in parallel and compete for findings. Your dedicated account manager keeps you updated.
- Report. In your template or ours. Every finding has a CVSS v4.0 vector, impact, reproduction steps and recommendations. Retest after fixes.
- Next project. Our engineers note what the client will need next. We include this list in the project report, and it immediately begins to facilitate upselling.
Partner stories
Names are confidential; the stories are real.
- Referrals and swapped departments. An SEO agency in Kyiv. We met at a Web3 conference. They became our marketing department, and we became their security department. We exchange clients and receive referral rewards from one another.
- Under the partner’s brand. A software engineering company with 500+ engineers. For several years we have run penetration tests under their brand for one of their enterprise clients. When another client needed a CISO, they brought us in for a year as vCISO.
- Under the partner’s brand in the Web3 space. We were approached by a company that specializes in both Web2 and Web3 security audits. Initially, they engaged us to conduct a standard Web2 penetration test for one of their clients. Impressed by the value we offered—the balance between price and quality—the partner decided to expand the scope of our collaboration to include Web3 audits. Over the course of several years, the partner has commissioned us to perform smart contract audits and various other types of security assessments.
- Building a security function. An IT integrator in Central Asia had no security team. Their client, a leading retail chain in the region, needed a full security function. Under the integrator’s contract, we built the technical protection and security management, then recruited the client’s security team. The engagement ran for about three years. We are now repeating the model with a partner in a neighbouring country.
What we deliver
- Penetration testing: web applications, APIs, cloud, networks, OT/ICS, etc.
- Compliance: ISO 27001, SOC 2, VDA ISA / TISAX, NIS2, PCI DSS, GDPR, etc.
- vCISO: security strategy, policies, audits and the team that executes them
- Smart contract audits: numerous blockchains and languages
- Incident investigation and readiness
- Security training for users, software developers and cybersecurity specialists
- more than 30 additional services
Why partners stay
- Two independent teams on every pentest. They compete for findings, so fewer issues slip through.
- We response within two business days during the sales phase, and in accordance with the SLA throughout the project. In case of an incident, the response time is within 1 hour; for most other matters, the response time is 1–2 business days.
- Continuous quality improvement in line with Kaizen.
- One relationship for years. If a specialist leaves or goes on holiday, we replace them; the relationship stays.
- We stay after the report. Our engineers note what the client will need next, so you have the next opportunity ready.
- English, Ukrainian and Russian. Contracts with our subsidiary in the EU (Portugal), USA or Ukraine; crypto accepted.
What you get from day one
- A dedicated account manager.
- A service presentation and a project report template under your brand.
- Sample reports and our certificates for your sales conversations.
- Six free tools to offer your clients: a website security scanner, the scau.pro smart contract check, ISO 27001 and VDA ISA / TISAX self-assessments, an IT/OT audit calculator and the H-X Cybersecurity Agent.
FAQ
Q. Will you contact my client directly?
A. Only if you want us to. Under your brand, we appear only as part of your team.
Q. Do you require exclusivity?
A. No.
Q. Can we start with one project?
A. Yes. Most of our partnerships started with one.
Q. Which model should I choose?
A. If you are not sure, start with a referral or a resale, and move to your own brand when requests come regularly. Write “Help me choose a partnership model” in the form, and we will suggest a model after a short call.
Q. How is the referral fee paid?
A. 10% by default, after the client pays us, by bank transfer or in crypto.
Q. Do I need technical knowledge?
A. Not for referrals. In the other models, our experts join any call where you need them.
Q. What does a pentest cost?
A. It depends on scope. You get a partner price after a short scoping call.
Q. Where do you work?
A. Worldwide, excluding countries subject to sanctions by the U.S., the European Union, and Ukraine. Most clients are in the EU, the UK, Ukraine, the US and Central Asia. We work in English, Ukrainian and Russian.