Sell a Security Audit Online, Not a Live Pentest Call

You can sell a security audit online by packaging it as a scoped Brillay Custom Work: a follower submits their app, site, or codebase, pays a fixed price upfront, and you deliver a written report on a set turnaround. This works as a documentation-and-configuration review, not a live, formally authorized penetration-testing engagement against production systems. Custom Work lets you offer clearly scoped commissions and services: you set the price, the scope and the delivery time, and followers submit a brief and pay before you start.

No monthly fee, you only pay a small platform fee when you get paid. 8% platform fee when a follower pays for work, 5% platform fee on tips and goals. Card processing is separate. Brillay — Pricing

A steady trickle of "can you check this for security issues?" messages is common for anyone visible online as a developer or security-minded creator. Exploitation of software vulnerabilities is now the leading initial access vector for breaches at 31% — up from 20% the prior year — overtaking stolen credentials, according to Verizon's 2026 Data Breach Investigations Report (Verizon 2026 DBIR). That measured shift is one reason buyers increasingly want a trusted developer to look at their app or site before something goes wrong, rather than after.

"While the velocity of cyber threats—driven by AI and faster vulnerability exploitation—is increasing, the foundational principles of security and strong risk management remain the most effective defense," said Daniel Lawson, SVP Global Solutions, Verizon Business.

What counts as a paid security audit?

A paid security audit sold through Custom Work is a scoped written deliverable: the follower submits a repo link, staging URL, config export, or architecture doc, pays a fixed price upfront, and receives a written report naming issues, severity, and suggested fixes within the stated delivery time. It is a review, not a live penetration test.

Custom Work lets you sell a small, defined deliverable with a set price and delivery time; followers can attach files, and you can deliver text plus files of any allowed type and/or a link (Brillay — Custom Work and Brillay — How It Works). Other technical creators structure their own scoped reviews the same way — see how to package and sell an AI-workflow audit for a non-security example of the same format.

Reviewing code, configuration, and auth flows against a published checklist is realistic work for a written, asynchronous deliverable. OWASP reports that 100% of the applications tested were found to have some form of broken access control, keeping A01 Broken Access Control at #1 with 40 mapped CWEs and 1,839,701 recorded occurrences (OWASP Top 10:2025, A01). OWASP also reports that 100% of the applications tested were found to have some form of misconfiguration, with an average incidence rate of 3.00% and over 719,000 occurrences (OWASP Top 10:2025, A02 Security Misconfiguration); OWASP notes that Security Misconfiguration moved up from #5 in 2021 to #2 in 2025. Those two categories alone give a written audit a defensible, checkable agenda.

Why is a written review different from a penetration test?

A written review reads code, configuration, and documentation the buyer hands over voluntarily. A penetration test actively attempts to exploit a live system and begins with a signed, defined scope under US government guidance. The difference is legal and contractual, not stylistic, and it belongs in the listing copy.

CISA's own penetration testing service documents the required signed scope in a single sentence:

"A Rules of Engagement is drafted and signed by both parties that describe the scope of the engagement."

NIST defines Rules of Engagement as "detailed guidelines and constraints regarding the execution of information security testing," established before a security test begins, in Special Publication 800-115, Technical Guide to Information Security Testing and Assessment (NIST SP 800-115). The governing statute is 18 U.S.C. § 1030(a)(2), which makes it an offense to intentionally access a computer "without authorization" or in a way that "exceeds authorized access" (18 U.S.C. § 1030, US House Office of the Law Revision Counsel). On May 19, 2022, the US Department of Justice announced a revised CFAA charging policy that, in its own words, "for the first time directs that good-faith security research should not be charged" (DOJ press release, May 19, 2022). That policy governs federal charging discretion; it is not a substitute for written permission from the system owner, and none of the above is legal advice — consult a qualified attorney before running any active test.

Practical takeaway: Custom Work should be sold as a review of material the follower voluntarily submits, with active exploitation named as an explicit exclusion — the same structure that lets you run security consulting without booking a single call.

Should this be a custom request or a quick paid question?

Match the request's depth to the format. A structured review of a whole app, site, or codebase needs Custom Work, which accepts attached files from followers and lets you deliver a written report.

Any request that needs an attached repo link, config export, or architecture diagram belongs in a custom request rather than a Paid Question.

What should a security-audit listing include?

A security-audit listing should state six things before anyone pays: the input you accept, the scope boundary, the reference standard you review against, the deliverable, the delivery time, and the exclusions. Naming a published standard such as the OWASP Top Ten or NIST CSF 2.0 gives the buyer a concrete definition of "reviewed."

• Input: A repo/branch link, staging URL, exported config, or architecture doc — not production credentials.
• Scope boundary: State plainly that the service is a code, configuration, and documentation review, not active exploitation of a live system.
• Reference standard: Name a published framework. The NIST Cybersecurity Framework 2.0 defines six Core Functions — GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER — that "organize cybersecurity outcomes at their highest level".
• Deliverable: A written report with findings, severity, and suggested fixes, optionally paired with a recorded walkthrough.
• Delivery time: Brillay caps Custom Work and Personalized Videos delivery time at up to 5 days, so a stated delivery time must fall within that window.
• Exclusions: No live exploitation, no third-party infrastructure the buyer doesn't own or control, and no compliance certification (such as SOC 2 or PCI-DSS) implied by the review.

How do you scope a security audit responsibly?

Scope a security audit to systems the buyer owns and can approve, then deliver a written review on your own time within the window you set. Ask for a link, export, or document instead of live production credentials, and state that the deliverable is a written assessment — not a certification, a compliance sign-off, or a guarantee of security. The same discipline applies to adjacent technical review offers, including how creators scope and sell a UX audit online.

If a request grows beyond what was purchased — for example, someone submits a live production environment and asks for active exploitation rather than a code and config review — a creator can decline the request rather than absorb unpaid or out-of-scope work. The US Federal Trade Commission's cybersecurity guidance for small businesses frames security as an ongoing practice rather than a one-time checkbox, which supports selling a single asynchronous review as one input among several, never as a full substitute for the buyer's own security program.

How should you package and price a security audit?

Package a security audit as two to four fixed-scope tiers that scale with the size of what is reviewed and the depth of the report. You set the price and delivery time for Custom Work. The example bands below are illustrative scoping anchors for building your own ladder — they are not market rates, benchmark data, or earnings claims.

Three rules keep the ladder defensible. First, price by reviewed surface area, not per message: a single-service auth check and a 40-file monorepo are different jobs — the same surface-area logic is what makes it possible to sell a cloud cost audit using tiers instead of hourly billing. Second, cap the top tier at a delivery time you can meet within Brillay's 120-hour delivery limit for Custom Work. Third, tie the mid tier to a named checklist so the buyer knows what "full report" means — the OWASP Top 10:2025 mapped 40 CWEs to A01 Broken Access Control alone, which is a concrete, finite agenda a written report can cover.

Every figure in the table above is an illustrative example for scoping purposes, not an earnings claim, a market survey, or a Brillay-recommended price.

What else can you sell around security work?

A security-focused Brillay page can offer a structured audit alongside other paid options. Five adjacent offers cover requests that do not fit a bounded written report: Paid Questions for one-line scam checks, Goals for open-ended research, Personalized Videos, Tips, and a separate Brand Collaboration Inquiries intake.

• Paid Questions: A one-off "is this a scam?" or "is this email phishing?" check, covered in monetize-is-this-a-scam-or-phishing-questions.
• Goals: Cash toward an open-ended vulnerability-research goal or a specific CVE chase, covered in fund-a-bug-bounty-or-cve-research-project.
• Personalized Videos: A congrats or encouragement message for someone who just shipped a security fix or passed an audit.
• Tips: A one-time thank-you from someone who found your free security content useful, with nothing to deliver in return.
• Brand Collaboration Inquiries: A separate intake for security-tooling vendors who want to discuss a partnership rather than pay for a personal audit.

How do you get a security-audit offer live?

To get a security-audit offer live, decide whether the request is a one-line question or a full review, write down the input, scope boundary, reference standard, deliverable, and delivery time, then publish the listing.

You can enable Custom Work without a security certification such as OSCP or CISSP as a platform prerequisite, and every Brillay offer has no follower minimum. That platform rule is separate from professional and contractual norms: represent your actual experience accurately, and do not imply a certification, formal audit standard, or compliance sign-off (such as SOC 2 or PCI-DSS) that the review does not provide.

The platform fee is set out above; card processing is a separate cost line: Stripe lists typical US domestic online-card pricing at 2.9% + $0.30 per successful charge, with international cards and currency conversion priced higher (Stripe pricing).

Frequently asked questions

Common questions about selling a security audit on Brillay cover certification requirements, the split between Paid Questions and Custom Work, whether live penetration testing fits the format, what to do with out-of-scope submissions, and what the platform costs. Short, sourced answers follow.

Do I need a security certification to sell an audit on Brillay?

You can enable Custom Work without a certification such as OSCP or CISSP as a platform prerequisite. Represent your actual experience accurately and avoid implying a formal audit standard or compliance certification the review does not provide.

Should I sell this as a Paid Question or a custom request?

Use Paid Questions for a single written gut-check, such as whether one link or email looks like phishing. Use Custom Work when the buyer needs to attach a config file or architecture doc or provide a repo link and receive a written report back.

Can this include an actual penetration test against a live system?

No. Sell this through Custom Work as a written code, configuration, and documentation review, with no live call or scheduling. CISA's penetration testing service states that "a Rules of Engagement is drafted and signed by both parties that describe the scope of the engagement", while 18 U.S.C. § 1030(a)(2) establishes that accessing a computer "without authorization" is a federal offense (18 U.S.C. § 1030). Active testing belongs in a separate, signed engagement.

What standard should a security-audit report be mapped to?

Two published standards work well for an asynchronous written report. The OWASP Top 10:2025 lists Broken Access Control at #1, with OWASP reporting that 100% of the applications tested were found to have some form of broken access control. The NIST Cybersecurity Framework 2.0 defines six Core Functions — GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER.

What if the submission is bigger or riskier than what was purchased?

Decline a request that falls outside the listed scope — for example, live production credentials submitted to a code-review offer — rather than accepting unpaid or out-of-scope work.

What does Brillay charge for this?

There is no monthly fee: the only charge is the platform fee stated near the top of this page, taken when a follower pays for a review, with card processing billed separately. There is no follower minimum, and payouts run through Stripe.

Create your free Brillay page and turn the next "can you check my app for vulnerabilities?" DM into a clearly scoped, paid security-audit offer.