What's useful
- Alerts and triage decisions: what fired, and whether an analyst judged it a true or false positive.
- Investigations: timelines, evidence and findings from real incidents.
- Case write-ups and reports: incident reports, penetration test findings, threat research.
- Security software: detection rules, tooling and product code you've built.
What qualifies
The listing is for security companies of roughly 20 to 2,000 employees, such as managed security providers, consultancies and product vendors.
What to check first
- Client data inside your records. Alerts and investigations are full of client IP addresses, hostnames, usernames and log content, much of it personal data. Client contracts and NDAs usually restrict how you use it.
- Who owns the reports. Penetration test and incident reports are often client deliverables owned by, or confidential to, the client.
- Third-party feeds. Threat intelligence feeds and commercial rule sets usually can't be redistributed.
- Your own code and research. Usually the clearest to license, once secrets and client data are removed.
What it's worth
Mercor lists potential company earnings of $20kâ$750k for cybersecurity companies, depending on what's in scope. That is Mercor's own figure, not a promise or guarantee from us.
Can client details be fully removed from alerts?
Often, by replacing identifiers consistently, but it takes care. Ask how it would be done for your data during scoping.
Is our detection logic worth more than the alerts?
Both can be valuable. Alerts with analyst verdicts are especially hard for buyers to find elsewhere.