← Earn Online Cookstown · All 125 ideas
Cybersecurity freelancing
Cybersecurity freelancing can include bug bounty research, vulnerability assessments and penetration testing, but work must stay within the client’s or programme’s authorised scope. This beginner module covers ways to find work, build practical skills and check the differences between UK and Irish rules.
Open the interactive guide (checklist, video, read-aloud) →In plain words
- You learn to find security problems safely.
- Only test systems when you have clear permission.
- Practise in safe training spaces first.
- Show your work with clear, private reports.
- Pay can change, and some work may pay nothing.
Who it suits
It may suit careful problem-solvers who enjoy learning how websites, APIs and security tools work, and who can explain findings clearly. It is not a shortcut to paid work: practise only in authorised environments and expect to build evidence of your skills.
Organisations pay for help finding security weaknesses before someone misuses them. They also value clear reports that explain the risk and how to fix it.
Step by step
- Learn security basics and practise only in authorised labs. Study web and API security, common weaknesses and how to explain a finding. Practise in deliberately vulnerable labs or other environments where testing is authorised; never try techniques on a real system without permission. About Ongoing; start with 30-minute sessions.
- Build a small portfolio from permitted practice. For each example, explain the issue, its possible impact, how you checked it safely and how it could be fixed. Remove secrets and personal data, and use only work you are allowed to share. About 1-2 days for a first example.
- Secure your own devices and accounts. Use strong account security and passkeys where available. The NCSC offers a free Cyber Action Toolkit for sole traders and small businesses. NCSC About 30-60 minutes.
- Choose one kind of security work to pursue. You might focus on bug bounty research, web application testing or security advice for small organisations. Describe what you will test, what you will deliver and what is outside your service in plain language. About 1-2 hours.
- Check each platform and campaign before applying. Read the current rules, eligibility conditions, fees and reward terms before you spend time applying. The Tryber.me listing describes creating a profile, accepting its terms and code of ethics, taking an assessment, and reviewing campaigns if approved. Jobify About 30-60 minutes per platform.
- Get clear permission and agree the test scope. Before testing, confirm in writing which systems and methods are allowed, when testing can happen and how findings must be reported. The Tryber.me listing says testing must follow the assigned programme’s scope and selected campaign work requires supplementary terms. Jobify About Before every test; allow 30-60 minutes to confirm.
- Start with a small, carefully bounded project. Choose work you can complete without rushing. Keep notes, avoid disrupting services and stop if you discover that an action is outside the agreed scope; ask the authorised contact what to do next. About A few hours to several days, depending on scope.
- Write a clear report for each finding. State what you observed, the possible impact, the safe evidence you collected and a practical fix. Share the report only with the authorised contact, using the agreed reporting process. About 1-3 hours per finding.
- Use feedback to improve and review business arrangements. Ask for feedback on your process and reports, then update your checklists. As you take on more client work, review business structure and insurance options; a UK guide discusses sole trader and limited company trade-offs and recommends considering professional indemnity and public liability cover. Vulnsy About 1-2 hours after a project.
Your first 15 minutes
Choose one authorised practice environment, complete a small web-security exercise, and write a short report with the finding, safe evidence and suggested fix.
The money
Price for the agreed work, time, preparation, reporting and any business costs, rather than assuming a bug bounty will pay. Set out the systems, methods, deliverables and limits in writing, and review your price as you gain experience. The available day-rate calculation is only a worked example, not a typical rate or earnings promise. <a href="https://www.vulnsy.com/blog/freelance-security-work" target="_blank" rel="noopener noreferrer">Vulnsy</a>
Example only: if you agree four hours of work at an assumed £30 per hour, that is £120 income; subtract £10 assumed costs and £110 remains before tax. In euros, four hours at an assumed €30 per hour is €120 income; subtract €10 assumed costs and €110 remains before tax. These are made-up figures for showing the maths, not a suggested rate or earnings promise.
The rules
Cybersecurity testing can be lawful in the UK and Ireland if you have lawful authority and stay within the agreed scope. Unauthorised access or other unauthorised activity can be an offence. Get clear permission before testing, and check the rules for your situation.
UK and Northern Ireland
- Permission and scope. Under the Computer Misuse Act, access is unauthorised if you lack the relevant authority or consent. Knowingly making a computer perform a function to get unauthorised access is an offence. The Act does not set out a specific exemption for penetration testing. Agree the authority and scope with your client before you test. Legislation.gov.uk Legislation.gov.uk
- Permission and licensing. The Act does not say that you must get written permission for penetration testing. This does not tell you whether other licensing rules apply or give you permission to test. Get clear consent. If you are unsure about your authority or scope, check with a solicitor. Legislation.gov.uk
- Trading income and tax. The first £1,000 of trading income each year is covered by the trading allowance. This is gross income before expenses. If your income is above that, you should tell HMRC. If you need to register for Self Assessment, the deadline is 5 October after the end of the tax year when you started trading. Check your situation with HMRC. GOV.UK Tax Help for Hustles GOV.UK
- Insurance. As your client work grows, consider professional indemnity and public liability insurance. These are not stated as legal requirements here, and no prices are given. Vulnsy
- Personal data and ICO fee. If your work involves personal data, check your data-protection responsibilities. Use the ICO self-assessment tool to see whether you need to pay a data protection fee. There is no general rule here for every sole trader. ICO
- Age and platform rules. There is no universal age limit or bug bounty platform eligibility rule stated here for the UK. Check the platform’s and each campaign’s current age, eligibility and contract rules before applying.
- Promotional posts. If you publish paid or affiliate promotional posts, label them clearly. For example, use “Ad”. ASA
Ireland
- Lawful authority and scope. The Criminal Justice (Offences Relating to Information Systems) Act makes it an offence to intentionally access an information system by infringing a security measure without lawful authority or reasonable excuse. The Act also covers specified interference, data alteration, interception, and tools or access data. Get authority from the owner or relevant right holder, and stay within scope. Irish Statute Book Irish Statute Book
- No testing licence stated. The Act does not set a requirement for penetration-testing businesses to register or get a licence. It does not give related fees or application deadlines. This does not let you test without lawful authority. If you are unsure about permission or cross-border work, check with a solicitor. Irish Statute Book
- Cross-border rules and penalties. The Act covers some acts involving systems inside and outside Ireland. The full wording of some cross-border conditions is not included here. Check the Act and get legal advice if your work crosses borders. For offences under sections 2, 4, 5, 6 or 9(1), the maximum on summary conviction is a class A fine, up to 12 months’ imprisonment, or both. On indictment, the maximum is a fine, up to 5 years’ imprisonment, or both. For a section 3 offence, the maximum on indictment is a fine, up to 10 years’ imprisonment, or both. The amount in euros for a class A fine is not stated here. Irish Statute Book Irish Statute Book
- Income tax and Form 11. If you work under PAYE, you generally need to register for self-assessment using Form 11 if your taxable non-PAYE income is over €5,000 or your gross non-PAYE income is over €30,000. Below those limits, declare it on Form 12 through myAccount. If you are self-employed, you pay income tax, PRSI (Class S) and USC through self-assessment. Preliminary tax is due by 31 October. Check your situation with Revenue. Revenue Citizens Information
- VAT threshold. The VAT registration threshold for services is €42,500. Check with Revenue whether your turnover and situation mean you must register. Revenue
- Insurance. As your client work grows, consider professional indemnity and public liability insurance. These are not stated as legal requirements here, and no prices are given. Vulnsy
- Age, platform and adverts. There is no universal age limit or bug bounty platform eligibility rule stated here for Ireland. Check each platform and campaign before applying. If you publish commercial promotional content, label it clearly. For example, use “#Ad”. CCPC
Checked against official sources: 22 October 2026. Not yet reviewed by a qualified tax or legal adviser. General guidance, not legal advice. Check the official link beside each point before you start.
Common mistakes
- Testing a system before permission and scope are clear.
- Assuming a bug bounty will pay or that every finding qualifies.
- Sharing evidence that contains secrets or personal data.
- Accepting a project that is too broad or unclear to finish safely.
- Treating a platform listing or service supplier as proof of available freelance work.
AI-made demonstration: this module has a 20-second street-chat video in the interactive guide. The presenter and the people in it are computer-generated, not real people.