Certification comes up under its own name, with a price attached. The business already knows what it needs, usually because somebody else told them, and the consultancy that publishes a cost and a timescale wins that work.
Client security questionnaires are a hidden market. Somebody staring at forty questions they cannot answer wants help that afternoon, and the search returns almost nothing written for them.
Incident searches are the most urgent in any sector. They come from a company in real trouble, at any hour, and the response has to be a number and a first instruction rather than a form.
Regulated sectors bring the steadiest clients. Healthcare, finance and anyone handling sensitive data have obligations that repeat annually, and those relationships continue for years.