Async Security Consulting, Not Booked Calls

Async security consulting means pricing a specific security request—judging whether a link is a phishing attempt, reviewing a cloud IAM misconfiguration, auditing an auth flow—as a fixed-scope task a follower submits and pays for upfront, instead of booking a call. The consultant replies with a written verdict, an annotated file, or a recorded walkthrough on their own schedule. Custom Work lets you offer clearly scoped commissions and services: you set the price, the scope and the delivery time, and followers submit a brief and pay before you start.

No monthly fee, you only pay a small platform fee when you get paid. 8% platform fee when a follower pays for work, 5% platform fee on tips and goals. Card processing is separate. pricing

Security questions tend to arrive as a DM after a talk or a viral thread: "Is this email a phishing attempt?" or "Can you glance at our IAM policy?" The instinct is to offer 15 minutes on a call. But most of these requests aren't asking for a conversation — they're asking for a judgment call or a written finding.

That backlog is measurable. HackerOne's 8th annual Hacker-Powered Security Report, published November 7, 2024, counted 78,042 valid vulnerability reports platform-wide across more than 1,300 customer programs in the single year it measured — a 12% year-over-year increase (HackerOne, Hacker-Powered Security Report, 8th edition). That figure is annual and platform-wide, not a per-consultant number, and it is a volume no single calendar of 30-minute calls can absorb.

On Brillay, a client can choose a custom request offer, pay upfront, and attach a suspicious email, an IAM export, or a config snippet through the creator's page (how it works).

What does "async security consulting" mean in practice?

Async security consulting turns a specific, recurring request into a priced offer with a defined input, output, and delivery time — answered without a live meeting. Instead of "book 20 minutes with me," the offer reads "send the suspicious email and headers, get a written verdict back within 24 hours."

This is not a general "hire me as your security advisor" retainer. It is a scoped deliverable — one phishing judgment call, one config reviewed, one auth flow diagnosed — sellable at a fixed price instead of a negotiated hourly rate, pairing a written review with a Paid Question for quicker asks.

Why do security consultants avoid booking calls for this work?

Security consultants skip booking calls because the value in most requests comes from reading an artifact and writing back a finding, not from real-time discussion. A calendar invite adds three costs a written verdict avoids: a scheduling round-trip, a working hour both parties share, and a wait until that hour arrives.

The inbound volume behind those requests is documented. The Anti-Phishing Working Group observed 971,181 phishing attacks in the first quarter of 2026, up 13.8% from 853,244 in the fourth quarter of 2025 (APWG, Phishing Activity Trends Report, 1st Quarter 2026, published May 21, 2026).

Remote and independent work is common in the developer population that sends these DMs: 32.4% of developers report working fully remote and 13.9% describe their employment as independent contractor, freelancer, or self-employed, per Stack Overflow's 2025 Developer Survey. Separately, as a practical observation from running this kind of offer: a booking calendar requires two parties to locate one working hour they both have free, while a written verdict delivered on the consultant's own schedule requires no shared hour at all.

Calls remain the right format when the value depends on live interaction — walking a team through an active incident together. On Brillay, async security consulting uses a submission-and-reply flow: no live call, no scheduling.

Which requests fit a quick paid question instead of a review?

Requests like "does this email look like phishing?" or "is this a known anti-pattern?" are read-and-answer verdicts rather than file-based diagnostics.

For Paid Questions, you set the price and reply time, and your client gets one written reply.

Demand for that exact judgment call is well documented at national scale. The FBI's Internet Crime Complaint Center received 1,008,597 complaints in 2025, up from 859,532 in 2024, with phishing and spoofing among the most-reported crime types.

Further examples: "Should I rotate this API key or is the exposure low-risk?" or "Is this login flow vulnerable to credential stuffing?" Turning "is this a scam?" DMs into Paid Questions covers this request type in more depth.

Which requests need a full security review instead?

With Custom Work, you set the price and delivery time, then deliver text plus files of any allowed type and/or a link.

For both Custom Work and Paid Questions, you set the delivery or reply time from one hour to five days. Those two settings are the only delivery time controls Brillay documents for security work.

Configuration and access-control findings dominate the artifacts that arrive for review. In the OWASP Top 10:2025, published November 2025, Security Misconfiguration moved up to #2 and "100% of the applications tested were found to have some form of misconfiguration" (OWASP Foundation, OWASP Top 10:2025, A02 Security Misconfiguration). Broken Access Control held the #1 position in the same edition, also present in some form in 100% of tested applications.

Cloud reviews follow the same pattern in Google Cloud's own reporting: Google Cloud reported that in the second half of 2025 third-party software exploitation accounted for 44.5% of observed initial-access cases and overtook weak or absent credentials, which fell to 27.2% (Google Cloud, Cloud Threat Horizons Report H1 2026).

CVE submissions are climbing fast enough that one unpaid "quick look" backlog can outgrow what a single person absorbs for free: CVE submissions increased 263% between 2020 and 2025, according to NIST (NIST, "NIST Updates NVD Operations to Address Record CVE Growth," April 2026).

"We enriched nearly 42,000 CVEs in 2025 — 45% more than any prior year. But this increased productivity is not enough to keep up with growing submissions." — NIST, National Vulnerability Database update, April 2026

The table below maps request types to offers. Delivery time values in the last column are illustrative recommendations from this article, not Brillay defaults or guarantees — every one of them sits inside Brillay's creator-set range of 1–24 hours or 1–5 days, capped at up to 5 days.

A request that is materially bigger than the scope — a full penetration test sent to a single-config-review offer — can be declined rather than absorbed as unpaid extra work.

How is this different from funding your own research?

Async security consulting is a paid deliverable for one client's specific request; funding your own vulnerability research is a different transaction with no commissioning client. A client who wants their own product reviewed is buying a deliverable through Custom Work. A researcher chasing a CVE candidate of their own is raising money toward a stated goal instead.

Goals cover the second case: supporters contribute one time toward a named research goal with a progress bar, with no rewards to deliver and no all-or-nothing cutoff. Both formats can run side by side on one page; funding a bug bounty or CVE research project covers how to scope that goal.

Bounty payouts stay separate from both models. HackerOne's 9th annual Hacker-Powered Security Report, released October 1, 2025, found that bug bounty programs on its platform paid researchers $81 million over the prior year, up 13% (HackerOne press release, October 1, 2025). Bounty money is earned per accepted finding through a vendor's own program, never through Custom Work or Goals.

"Hackers are becoming builders. By crafting AI enhancements throughout our workflows, we're amplifying our unique tradecraft to hack deeper, faster." — James Kettle, Director of Research at PortSwigger, quoted in HackerOne's 9th annual Hacker-Powered Security Report press release, October 1, 2025

How should you price async security consulting work?

Price by the exact result: for example, $25 for one written phishing verdict, then charge a separate fixed price for a defined config review that requires files. A fixed price for "one IAM policy reviewed within 48 hours" is easier to buy than an open-ended hourly quote. Write down exactly what is included and keep the submitted request and delivered work clear in case a client later disputes the charge.

Any price named in this article is illustrative and not a guarantee. Brillay publishes no benchmark rates for security work; the only figure it documents is its own platform fee, stated above, which leaves what a phishing verdict or a config review is worth entirely to the consultant selling it.

Compared with a calendar-booking tool built around paid 1:1 sessions, Paid Questions offer a written answer instead of another call, while Custom Work handles scoped deliverables — see the developer-focused Topmate comparison. A security consultant publishes the review or verdict offer straight from their own page — no roster of consultants to be ranked against, and no application to clear before the first phishing verdict ships.

What should a security consulting listing exclude?

A security consulting listing should exclude everything the price was never set for: full penetration tests, ongoing monitoring, incident response, and remediation beyond the review itself. State the exact input required, the exact output delivered — a written verdict, an annotated file, or a short recorded walkthrough — and put that boundary in the listing text.

Selling a scoped technical review is not the same as a certified audit or regulated legal advice, and a creator should describe their background accurately rather than implying a certification they do not hold. There is nothing to apply for to offer Custom Work or Paid Questions on Brillay, though local professional-services rules still vary by jurisdiction. Frame the offer around the deliverable, never around a guarantee about outcomes.

How do you get an async security consulting offer live?

Get an async security consulting offer live by publishing one narrow, bounded offer — a single config review, or a priced phishing-judgment question — instead of a general "security consulting" listing. Write the exact submission requirement, the deliverable format, and the delivery time before publishing, so the first client needs no clarifying message.

One page can pair a review offer with Tips, which let supporters of a creator's security write-ups send a one-time amount with nothing to deliver in return, and Brand Collaboration Inquiries, which route security-tooling vendors into a separate inbox.

Frequently asked questions

Common questions about async security consulting cover five things: whether a live call option is still needed, how large a submission a client may send, how a paid question differs from a full review, how a review differs from funding your own research, and what the platform charges. Each answer below cites Brillay's own product documentation.

Do I need to offer a live call option too?

No. You reply in writing on your own time.

Can a client send a whole codebase for review?

Custom Work supports file attachments, but the offer should state a clear scope — one config file or one module, not an entire repository. Followers pay upfront; you can decline a request.

What's the difference between a Paid Question and a custom request here?

A Paid Question is one typed security question answered with one written reply, with nothing attached either way — right for a verdict on a link or a pasted header. Custom Work accepts attached files from the client, and you deliver text plus files of any allowed type and/or a link by the delivery time you set, up to five days.

Is this the same as funding my own vulnerability research?

No. Custom Work is for one client's deliverable; funding your own research uses a goal in Goals, with a progress bar and no single commissioning client. See funding a bug bounty or CVE research project for that model.

What does Brillay charge for this?

Clients pay as guests with no account needed; purchases are one time, with no membership, and Paid Questions, Custom Work, Tips, Goals, and Brand Collaboration Inquiries can all sit behind one link. Creators in 41 countries can get paid; followers pay by card from anywhere. There is no follower minimum and nothing to apply for. Brillay's own charge is the platform fee already set out above, billed only when a follower pays — nothing monthly. Card processing runs separately, at Stripe's own rate: US online-card processing runs 2.9% + $0.30 per successful charge, per Stripe's published pricing.

You do not need a large following or an application: create your free Brillay page, set one clear price, and send people who ask "is this a phishing link?" to a paid answer instead of awkwardly negotiating in DMs.