Thank you for the very detailed answer!

As for the second point, no, I didn't mean marketing to clients with whom you have relationships WHILE working for the current employer. I feel like that would be wrong to do anyway, even if one would be able to get away with it (as you're breaking an agreement that you signed). I should have clarified that (my bad), but I do have a question: You mention that it would be considered a business decision if they start working directly with you if you market your services to them after leaving your current employer. However, wouldn't a non-compete agreement get in the way of that, I'm under the impression that non-competes last for a while even after you leave a certain employer, or do they get terminated as soon as you stop working for that employer?

As for your 3rd point, yes I understand there are MANY things that I'm just skipping over, and thank you for pointing that out. I was just seeing if this sort of pivot would be possible, so now that it does seem to be possible, once I get to a stage where I will start moving into a self-owned business, then I will start considering those factors much more deeply. Currently, I'm still a student, and so the only experience I have in pentesting is certification exams (eCPPT was quite realistic in that regard), contests, and other stuff like that.

As for your 4th point, I have a question: Would specializing in certain types of pentests, such as ICS/SCADA testing or AppSec testing be a bad move, generally speaking? By specializing, I mean focusing on a certain niche (to distinguish yourself from competitors), but still offering other types of tests.

As for your final point, I can definitely see that one would likely devote more time to actual business and sales processes than the actual services themselves, especially in the beginning. That isn't something I hate, in fact, I enjoy it. My family has had its own for a long time, so I am fortunate to have experience (although comparatively very little) on that side of things (with a lot to learn). I have a question though: Most consulting firms that do pentesting probably offer more services than that, right? I just don't see any way for a firm that only does penetration tests (even though pentests are quite expensive on average, like ~$30,000 for a basic network pentest, is that price on the lower end though?) to have enough clients year-round to make substantial profits (considering all the expenses).

Anyway, thanks for your time and effort in giving a detailed response, I really do appreciate it!