Staffing snapshot: operators, skills, and compensation stack
This is not a volume business held together by tools. Premium demand comes from verified security outcomes and retesting discipline, not AI scan volume. The Mythos token cost is tiny relative to labor and client trust, but the service must pay for legal scope, triage quality, and a credible remediation brand.
Revenue opportunity
Fast assessment ($15k–$35k)
One scoped repo/config review, short report, remediation handoff.
Deep review ($45k–$120k)
Dependency, config, edge API, and service surface review with ownership-driven fixes.
Retainer ($8k–$25k/month)
Release-level review for fast-moving product teams with continuity and verified retest.
Diligence package
Buyer/acquirer technical risk inventory and practical current-state posture.
Remediation support
Fix support plus independent retest after patches ship.
Dual-use red flags
Only defensible, authorized work; explicitly banned scope creep.
Valuation framing
| Metric | Conservative | Mid | High |
|---|---|---|---|
| Year 1 revenue | $800,000 | $1,350,000 | $2,400,000 |
| Year 3 revenue | $2,200,000 | $4,100,000 | $7,800,000 |
| Valuation range at exit | 2–4x revenue | 3–5x revenue | 6–8x EBITDA |
These are scenario ranges for planning, not guarantees. Actual valuation depends on trust level, proof of outcomes, repeatability and market expansion.
Cost per engagement model
| Driver | Low | High | Notes |
|---|---|---|---|
| Mythos-class token spend | $15 | $2,000 | legacy-state input + output budget per engagement |
| Human engineer time | $8,000 | $45,000 | real triage, fixes, retries, and reporting |
| Client legal/authorizations | $0 | $12,000 | externally charged in many packages |
| Re-certification retest | $500 | $8,000 | set-in stone retest fee to prevent profit loss |
| Estimated gross margin | 60% | 85% | service delivery units, dependent on package type and engineering involvement |
Bottom line: roughly $7,000–$120,000 per sale, with projected 60–85% gross and 15–30% net after internal staffing. Proceed only if founder/operator capacity exists and legal scope is maintained.
Next pages
Staffing · Financials · Risks