# Starting a cybersecurity company in 2026: the complete guide


# Starting a cybersecurity company in 2026: legal status, funding, offer and sales

**Starting a cybersecurity company** appeals to more and more professionals in the sector: demand is exploding, skills are scarce, and the French market weighs more than 8 billion euros. Yet between choosing a legal status, insurance, funding the first months and the difficulty of selling security to wary customers, the road is full of pitfalls.

I have always dreamed of entrepreneurship. At 16, I coded my first website. At 18, I founded my first company, somewhere between events and software development. Ten years later, I founded a second one, Trackflaw, specialised in penetration testing, then Flawfence, a SaaS platform for attack surface assessment. This guide gathers what I wish I had known before starting, in a rawer, more direct format: my daily life as a startup founder, my struggles and my wins.

{{< admonition abstract "In brief" >}}
- **Product-market fit**: identify the precise problem you solve, and choose between pure expertise and a product approach.
- **Legal status**: sole proprietorship to prototype, SAS to scale and raise, SARL for a stable business without fundraising.
- **Three must-haves**: liability clauses, solid NDAs and terms of sale, cyber liability insurance.
- **Funding**: bootstrapping and unemployment benefits, then JEI, R&D tax credits and Bpifrance, fundraising only when the product requires it.
- **Sales**: a long, trust-based cycle, marketing by proof, networking, and the phone rather than mass email.
- **Mindset**: start small, respect your balance, it is a marathon.
{{< /admonition >}}

{{< youtube dBFHm0U2GD4 >}}

## Why start a cybersecurity company in 2026?

The context has never been more favourable. Data breaches are multiplying, regulations such as NIS2 will force between 15,000 and 18,000 French entities to strengthen their defences, and 15,000 cyber expert positions will remain vacant by 2030. For a competent professional, demand is there. But demand is not enough: the sector is full of players, labels and promises, and trust is earned slowly.

## 1. Genesis: finding your product-market fit

It all starts with **analysing the need**. Why would the market need yet another solution? If you cannot explain in one sentence which precise problem you solve, and for whom, it is too early to create a company.

For Trackflaw, the idea came from a field observation: too many penetration tests boiled down to an automated scanner and an unreadable report. The problem to solve at launch was clear: deliver **highly technical**, exhaustive services, with deliverables understandable by management as well as by technical teams.

Then comes the question of **differentiation**: pure technical expertise, or a product and SaaS approach? Expertise is sold by the hour and does not scale. A product requires far more upfront investment, but creates recurring revenue. This reasoning led us, a few years later, towards Flawfence.

## 2. Which legal status for a cybersecurity company?

### The sole proprietorship (micro-entreprise): the sandbox

This is the "test" status, ideal for launching a small tool or doing freelance consulting at the beginning.

- **Pros**: ultra-simplified formalities (the company is created in 15 minutes), minimal accounting, and no revenue means no charges.
- **Cons**: a revenue cap of 77,700 euros for services and 37,500 euros for the VAT exemption, fragile credibility when selling to large accounts, and possible confusion between personal and professional assets, risky in a major cyber dispute.

**Verdict**: keep it for the prototyping phase or solo consulting.

### The SAS / SASU: the tech standard

This is the preferred structure of cyber startups.

- **Contractual flexibility**: custom bylaws, essential for a solid shareholders' agreement.
- **Investors**: if you plan to raise funds, the SAS is unavoidable. It allows different share classes, preferred shares and BSPCE stock warrants for your future employees.
- **Social protection**: the president is treated as an employee. Expensive in contributions (about 80% of net pay), but better protected, and you pay nothing if you do not pay yourself a salary.
- **Dividends**: easier to distribute, with the 30% flat tax.

### The SARL / EURL: the cautious approach

A more rigid structure, but often cheaper in the long run if you are not seeking immediate fundraising.

- **Social cost**: the manager is self-employed (TNS), with lower contributions than in a SAS (about 45% of net pay).
- **Stability**: bylaws tightly framed by law, leaving less room for improvisation or error.
- **The brake**: bringing in investors or exiting the company is much more complex than in a SAS.

| Criterion | Sole proprietorship | SAS / SASU | SARL / EURL |
|---|---|---|---|
| Setup | 15 minutes | Custom bylaws | Framed bylaws |
| Revenue cap | 77,700 euros (services) | None | None |
| Founder status | Independent | Employee-like (about 80% of net) | Self-employed (about 45% of net) |
| Fundraising | Impossible | Ideal (share classes, BSPCE) | Complex |
| Recommended use | Prototype, solo consulting | Product startup, scaling | Stable business without fundraising |

### The legal framework specific to cyber

Whatever the structure, three topics are non-negotiable:

1. **Liability clauses**, fundamental when you handle vulnerabilities and production systems. A penetration test always relies on a written mandate and a precise scope.
2. **Non-disclosure agreements (NDA)** and solid terms and conditions of sale, framing the handling of customer data.
3. **Cyber professional liability insurance**: the first expense not to neglect. A penetration test that goes wrong without insurance can end a young company.

## 3. Financing: from bootstrapping to fundraising

**Bootstrapping** means funding the first months with your own money or with unemployment benefits (ARE), which remains one of the best seed mechanisms in France.

**Innovation support** then takes over:

- the **JEI** status (Young Innovative Company) and its social contribution exemptions;
- the **CIR / CII** (research and innovation tax credits) to fund R&D;
- **Bpifrance** grants, notably the French Tech grant.

**Fundraising** only becomes necessary once the product requires an investment that service revenue cannot absorb. For a tool like Flawfence, the question arises as soon as R&D exceeds what penetration testing engagements can fund.

{{< admonition tip "Two pieces of advice I wish I had received" >}}
- **Keep a job on the side** at the beginning, or a consulting activity that pays the bills while the product is being built.
- **The first months are the hardest.** No customers, no references, no cash. It is normal, and it passes.
{{< /admonition >}}

## 4. Building the offer: from idea to MVP

Going from idea to **MVP** (Minimum Viable Product) is the step everyone underestimates.

For Trackflaw, it meant turning a methodology and internal tools into a **marketable offer**: clear scopes (external, internal and mobile penetration testing, incident response), standardised deliverables and a readable price list. We detail this thinking in our articles on [the budget of a penetration test](/en/what-budget-to-provide-for-its-intrusion-test/) and [choosing a provider](/en/pentest-provider/).

For Flawfence, the logic is one of **moving upmarket** to create **recurring revenue**: where a pentest is a snapshot at a given moment, Flawfence continuously monitors the external attack surface, maps exposed assets and shadow IT, and scans for vulnerabilities agentically. The service feeds the product, and the product opens doors for the service.

## 5. Selling cybersecurity: the go-to-market strategy

Why is selling cybersecurity so slow? Because everything rests on **trust**: a customer opens its systems to you. Add prior audits of your own security and annual budgets you have to wait for.

What works is **marketing by proof**: webinars, white papers and above all contributions to the community (open source, CTFs, articles, videos). Not forgetting the **network** and the ecosystem: Campus Cyber, competitiveness clusters, events.

{{< admonition failure "My pitfalls" >}}
- **Favouring email**: in cyber, a cold email ends up in spam or in oblivion.
- **Insisting on mass outreach**: sending 500 generic messages does not replace 10 qualified conversations.
- **Neglecting the target**: talking to everyone means talking to no one.
{{< /admonition >}}

{{< admonition success "My wins" >}}
- **The phone**: a well-prepared call beats any email sequence.
- **Refocusing the target on MSSPs**: managed security service providers need pentest capacity and visibility on their customers' attack surface. A natural distribution channel for Flawfence.
{{< /admonition >}}

One very real limit remains: the technical founder is over-solicited on tech, and has to learn to **delegate**. A topic that deserves an article of its own.

## Frequently asked questions

### Which status should a freelance pentester choose?

The sole proprietorship is fine to start solo, as long as revenue stays under the 77,700 euro cap and customers are SMEs. As soon as engagements target large accounts or the business exceeds the cap, the SASU offers far better credibility and protection.

### Do you need a certification to start a cybersecurity company?

No certification is legally required to perform penetration tests. However, recognised certifications (OSCP, CEH, vendor certifications) and qualifications such as PASSI for audit providers reassure customers and are sometimes required in tenders.

### How much does cyber liability insurance cost?

The cost varies with revenue, covered activities and coverage limits, from a few hundred to several thousand euros per year. It is an essential investment from the very first engagement.

### How do you find your first cybersecurity customers?

Through your network (former employers, local ecosystem, Campus Cyber), through proof (technical content, open source contributions) and through targeted phone prospecting. Partners such as MSSPs and integrators are also an effective entry point.

## Key takeaways

It all comes down to **mindset**. Start small, do not be too greedy, and respect your work-life balance: it is a marathon, not a sprint.

Flawfence keeps growing fast, and we are looking for a **business developer** to support that growth. If this speaks to you, [get in touch](https://trackflaw.com/commande).

{{< admonition info "Going further" >}}
- [What budget should you plan for a penetration test?](/en/what-budget-to-provide-for-its-intrusion-test/)
- [Choosing your penetration testing provider](/en/pentest-provider/)
- [Discover Flawfence](https://flawfence.com)
{{< /admonition >}}