White label and subcontracted testing
Subcontracted work is how most small Canadian testing practices fill the bench in year one. It pays less per day and costs nothing to acquire, which is a good trade until it becomes the whole business and you find you have no clients of your own.
Wholesale testing days in Canada go for roughly 55 to 75 percent of retail, which is about $900 to $1,900 CAD a day against a $1,500 to $2,800 retail rate. You give up the margin and the client relationship, and you get utilisation with no sales cost and no proposal cycle. Treat it as a floor under your capacity, not as the business, and cap it at somewhere between a third and a half of your billable days.
55 to 75% Of retail, typical Canadian wholesale rate
$900 to $1,900 Subcontract day rate, CAD
One third to one half Of billable days, a sensible ceiling
Who buys subcontracted testing
| Buyer | What they need | What to watch |
|---|---|---|
| A larger testing firm with overflow | Capacity on a date they have already sold | Feast and famine. They call when they are full, which is not predictable |
| An MSP or MSSP | A testing capability they do not have but their clients ask for | Scope quality. They often sell before scoping |
| A compliance consultancy or vCISO practice | The test their readiness client now needs | The best of these relationships. Usually referral rather than white label |
| A generalist IT reseller | A line item on a bigger deal | Margin pressure and a buyer who cannot describe the environment |
| A firm needing a specialism you have | Embedded, OT, mobile, thick client, Kubernetes | The best paid of the list. Specialism holds rate |
The last row is where subcontracting stops being a discount business. A firm that cannot test embedded devices is not shopping your rate against three others, because there are not three others. If you have a specialism, quote near retail and expect to get it.
The clauses that decide whether it is worth doing
- Who writes the report, and in whose template. White label means their template and their logo. Agree how many revision rounds are included, because unbounded revisions against an unfamiliar house style is where the margin goes.
- Who talks to the client. Usually not you. If you are expected to attend the readout as their staff, price that time and be clear on what you may and may not say.
- Retest. Establish whether the prime sold a retest and whether you are expected to deliver it inside the same fee. This is the most common unpriced obligation in subcontract work.
- Scope change. If the prime under-scoped, who absorbs it. Get a change-order mechanism in writing rather than a promise to be reasonable.
- Payment terms. Net 30 from your invoice, not from the prime's collection from their client. Pay-when-paid puts their cash-flow problem onto a smaller business.
- Non-solicitation, and how narrow it is. A clause covering the specific end client for 12 to 24 months is normal. One covering their whole client list, their prospects, or your entire market is not.
- Liability and insurance. Confirm whose insurance responds and that your own policy covers work performed as a subcontractor.
- Evidence handling and residency. Their client's contract may impose Canadian residency, and it flows down to you. See data residency during a penetration test.
The non-solicit is the clause to fight over
Everything else on that list is money. The non-solicitation clause is your future business. A prime who wants a broad restriction is asking you to accept wholesale rates and give up the right to build a practice, which is a bad trade at any rate. Narrow it to the named end client, put an end date on it, and carve out anyone who was already in your pipeline. Firms that ask for everything usually settle for the named client, because the clause they wrote is not enforceable as drafted.
Disclosure, and the ethics of it
The buyer-side pages on this site tell clients to ask whether any work is subcontracted and to require that the same background checks and confidentiality terms flow down. That advice is aimed at undisclosed subcontracting, not at subcontracting itself.
What is fine: a prime firm using a specialist subcontractor with the client's knowledge, under flowed-down terms, with the prime carrying responsibility for quality. What is not: a client believing they hired a named team and getting whoever was cheapest that week. If you are the subcontractor, ask the prime whether the client knows. If the answer is evasive, that tells you what their report quality is like too, and you will be the one who tested it.
Where the end client is in the public sector, disclosure is often a contractual requirement rather than a courtesy, and personnel screening may apply to you directly. The provincial detail is on public sector penetration testing in Ontario and the corresponding British Columbia and Quebec pages.
Being the prime instead
The inverse is worth considering once you have client relationships and a surface you do not cover. Subcontracting out the wireless or physical component of an engagement you own beats declining the work or learning on a client. Two rules make it survivable.
First, you carry the quality. Read their findings before they reach your client, in your template, and push back on anything you would not have written. Second, disclose it. Tell the client you are bringing in a named specialist for that component and why. Clients respond well to a firm that says what it does not do, and badly to discovering it later.
The trap, stated plainly
A practice that fills to 80 percent on subcontracted work has stable revenue, no marketing cost, and no business. The prime owns every client. If they bring testing in-house, lose their biggest account, or decide to squeeze the rate, you find out with weeks of notice and no pipeline. It happens often enough to be predictable.
Hold subcontracting to a share of your capacity and spend the freed time on the channels that build a practice of your own, which how to get penetration testing clients covers. Wholesale work should buy you the runway to stop needing it.
Be findable directly
A listing puts you in front of buyers who are comparing firms rather than in front of a prime looking for capacity.
List your firmCommon questions
What is a normal white label penetration testing rate in Canada?
Fifty-five to seventy-five percent of retail, so roughly $900 to $1,900 CAD a day. The top of that band is for specialisms the prime cannot staff: embedded and operational technology, thick client, Kubernetes, mobile with a real backend focus. Generalist web and network capacity sits at the bottom, because the prime has options.
Should a client be told the work is subcontracted?
Yes, and buyers on this site are told to ask. Disclosed subcontracting under flowed-down confidentiality and screening terms is normal and fine. Undisclosed substitution of the named team is not, and where the end client is a public body it is often a contract breach rather than a matter of taste.
What percentage of my work should be subcontracted?
Under half, and ideally under a third once you are past the first year. Above that the prime effectively controls your revenue, and a practice with no clients of its own has no protection when they bring testing in-house or reprice the arrangement. Use the utilisation it buys to build direct channels.
Who is liable if a subcontracted test causes an outage?
It depends on the subcontract, which is why it needs to say so. Normally the prime carries the client-facing liability and passes some of it down, so confirm the cap, confirm which insurance responds, and confirm your own policy covers work performed as a subcontractor. Do not assume the prime's certificate covers you.
Is a non-solicitation clause reasonable?
A narrow one is. Restricting you from approaching the specific end client for 12 to 24 months after the engagement is standard and fair. A clause covering the prime's entire client list, their prospects or your whole market is asking you to accept wholesale rates and forfeit your own practice. Negotiate it down before the first engagement, not after.