Who the programme is for

Any company a client already trusts with their systems. You do not need to be a security specialist, and being one is no disadvantage.

The programme is deliberately not agency-only. What it needs is a real relationship with people who own something worth testing — the delivery model is the same whoever you are, because NullSquare runs every assessment either way.

The four kinds of company we see most

Agencies and studios. You built it, and you still maintain it — so you are the first call when something breaks, and the natural first call when something is found.
IT providers and MSPs. You run the infrastructure a business depends on, under contract. Continuous testing fits the way you already sell: recurring, monitored, reported.
Security consultancies and MSSPs. You already advise on risk and clients act on what you say. This is continuous coverage between your own engagements, with none of your capacity spent on it.
Resellers and integrators. A catalogue, a procurement route and buyers who use it. One product to add, and no delivery obligation.

Everyone else

Anyone who applies and makes the case is read on the same terms. There is no vertical we exclude, and no company size that disqualifies an application on its own.