I&#x27;m not sure I follow here. Is your firm getting access to pentest reports from the consultancies it matches to clients? That seems untenable; clients tend to be very possessive about those reports.<p>Is your firm instead relying on self-assessment by clients? Then, like Ferruh Mavitunah said, I&#x27;m not clear how this system can work: most clients aren&#x27;t qualified to evaluate the effectiveness of a pentest, and will instead evaluate based on soft-skills.<p>I have another business question. The most lucrative clients across the board are &quot;house accounts&quot; that source repeated tests from a single firm. When one of these companies sources a consultancy through your market, what prevents them from bypassing you for all future engagements?<p>This is a race-to-the-bottom problem that plagues freelancer programming markets.