Updated October 2026
Selling cybersecurity firm data for AI training: what it's worth and who buys it
Endless excludes client environment details and credentials for IT and security work, which in a security firm covers most client deliverables.1
A security firm writes some of the most technical prose in business. A penetration test ends in a report that walks through each finding, how it was exploited and how to fix it. An incident response engagement ends in a timeline reconstructed from logs, with the attacker's path and the containment decisions. A managed detection team writes and tunes rules, triages alerts and documents why each was closed. Every one of these documents is reasoning about evidence.
Most of it is also about a client's weaknesses, which is why security firms face the hardest version of the ownership question in IT services. Endless excludes client environment details and credentials outright. What the firm wrote for itself is substantial: methodologies, report templates, detection rules written in-house, training labs, internal tooling and anonymized playbooks. micro1 names technology companies, and Polyshares buys tickets and Slack.
This page is for penetration testing firms, incident response teams, MSSPs and security consultancies with ten or more staff. It covers what a week of security work produces, which parts buyers can take, which buyers fit, and the questions that matter most in this niche.
Worth
What a security firm's data may be worth
Set for a typical security firm, 30 staff and 8 years of records. Move the sliders to match yours. Our estimate, not an offer.
Buyers
Which buyers want this data
Buyers whose own published rules fit cybersecurity firms. We can introduce you to the ones we work with.
Featured partners
micro1
Names technology companies and asks for SOPs, playbooks and knowledge bases, which is where a security firm's own method lives.5,2
- $100K to $2M+, micro1 says7
Watch out for: Says it removes personal details only "when relevant", so ask exactly how.10
Polyshares
Buys tickets and Slack, and excludes data held on behalf of clients, matching the line a security firm already draws.11,12
- $100K to $2M+, Polyshares says8
- None, Polyshares says13
- An offer in 1 to 2 weeks, then paid in 30 to 60 days14
Watch out for: Exclusive by default, and every deal it lists is exclusive with no end date.15,16
Everyone else we reviewed
By score, with full reviews. We have no referral agreement with these companies, so we do not link out to them.
Who wants this
Do buyers want cybersecurity firms?
No buyer publishes prices by industry, but their own intake forms show which industries they rate higher.
- Troveo puts it services or msp in its third of four demand tiers: "Standard buyer demand for your industry."23
- Polyshares takes it services and managed services, without marking it premium.24
- VMS, a broker, gives it services or msp standard weight when it estimates value.25
Which buyers take a security firm your size
Shown for 30 staff, a typical security firm. Ask whether contractors and part-time staff count.
micro1
Polyshares
No headcount rule; the length and texture of the record matter more28
Mode
20+ full-time US office staff (accounting firms 10+, law firms 6+)29
Pewter
20+ staff and 3+ years; by industry, from 10+ (healthcare) to 50+ (manufacturing, finance)30,31,32
Grepped
No headcount minimum stated33
Ventra
30+ US employees and 3+ years of records34
Mercor
None stated35
Troveo
No minimum stated; its estimator starts at 2036
Nyne
20+ US W-2 employees and 3+ years37
Endless
Roughly 30+ employees38
Supersoniq
50+ employees and 5+ years39
What buyers value
What in a security firm's records buyers value
What buyers look for in your records, and what to talk through with your buyer before anything leaves your systems.
| Data | Where it lives | Why a buyer values it | Raise with the buyer |
|---|---|---|---|
| Testing methodology and report templates | Internal wiki, report generator templates | How the firm scopes, tests and writes up findings, with no client in it. | Nothing specific |
| Detection rules and tuning history | Git repositories, SIEM content | Rules written, tested against false positives and revised, with the reasoning in commits. | Client-specific indicators embedded in rules. |
| Anonymized incident playbooks | Confluence, SOAR playbooks | Step-by-step response for ransomware, business email compromise and insider cases. | Details that could identify a past incident or client. |
| Alert triage notes | SOC ticketing, MDR platform | Why an alert was escalated or closed, written in volume by analysts. | Hostnames, user names and IPs from client environments. |
| Training labs and internal tools | GitHub, lab environments | Purpose-built exercises and scripts the firm wrote itself. | Third-party or open-source code inside the tooling. |
A week of records
A week of data at a security firm
- Monday: a pentest kickoff, with rules of engagement and a test plan written from the firm's template.
- Tuesday: 300 alerts triaged across MDR clients, eleven escalated with written reasons.
- Wednesday: a detection rule rewritten after a false-positive storm, with the change explained in the commit.
- Thursday: an incident timeline drafted from email logs for a business email compromise case.
- Friday: the internal methodology wiki updated with a new cloud testing section.
Process
How it works with each buyer
In each buyer's own words. Where a buyer publishes nothing, we say so.
micro1
- Internal docs, SOPs and playbooks, knowledge bases, project management workflows, internal comms, templates, CRM and workflow metadata, task histories2
- 30 to 200 employees27
- $100K-$2M+ per data package; over $1M for unique data7
- PII removed "when relevant"10
- The company keeps ownership of its data and reviews samples before release40
- Not published
Polyshares
Selling or closing
Selling or closing your security firm? License its data first
When a security firm is acquired, the buyer wants the analysts, the certifications and the client contracts. The methodology, rules and playbooks the firm wrote for itself are a separate body of work. Before a deal, ask each licensing company whether that body of work can be licensed without any client deliverable, and who checks it for residual client indicators.1,2
FAQ
Cybersecurity firms: questions, answered
They are code with history, which buyers describe wanting. Mercor takes repositories, commits, PRs and issues from GitHub, and a rule repository records why each rule changed.17
Every business is different, so this one is best talked through with the buyer you're working with. Their team goes over it with you before anything is signed.
Every business is different, so this one is best talked through with the buyer you're working with. Their team goes over it with you before anything is signed.
Before you sign
Questions to talk through with your buyer
Every business is different, so these are best talked through with the buyer you're working with. Their team goes over them with you before anything is signed.
Questions for this kind of business
- Which client agreements bar any use of engagement material, even anonymized?
- Who reviews rules and playbooks for residual client indicators before transfer?
- Can we restrict which recipients may use security material?
- Do customer, vendor or platform contracts, NDAs or API terms restrict this?
- Could the data include privileged material or trade secrets?
Questions for any buyer
- Is the license exclusive, and for how long?
- Can you sublicense the data, and to whom?
- Which AI labs will receive it, and will you tell us?
- How long do you keep it, and how is it deleted?
- What is your liability cap, and who indemnifies whom?
- Will the contract ban re-identification of people in the data?
- Who removes personal data, by what method, and do we approve it first?