How cybersecurity companies can sell data to AI companies

Last updated November 8, 2026How we research

In short

Cybersecurity companies can license detection rules, incident response playbooks, SOC triage notes, de-identified penetration test findings and training lab environments to AI companies. Mercor's published listing puts cybersecurity company payouts at $20,000 to $750,000 for firms with 20 to 2,000 staff. Threat intelligence shared under TLP restrictions, client findings and export-controlled tooling need clearing first.

Key takeaways

AI buyers most want these records from cybersecurity companies: (1) detection rules, signatures and queries your team wrote, (2) incident response playbooks and runbooks and (3) SOC triage notes and case histories, de-identified.
Published buyer range for cybersecurity companies: $20,000 to $750,000 per company.
Source: Mercor's published listing for cybersecurity companies, recorded by ddiy.co, checked October 2026.
Size buyers look for: 20 to 2,000 staff (Mercor).
The first rights issue to clear: EAR controls on intrusion software (ECCNs 4D004 and 4E001.c), with License Exception ACE limits by destination and end user. This page covers 5 more.
Sellers pay nothing to be assessed. We charge a success fee only when a deal completes, and the fee is agreed in writing before we introduce you to any buyer.

Book a free consultation How we protect you

Cybersecurity companies: what buyers look for

Records buyers ask for: Detection rules, signatures and queries your team wrote
Incident response playbooks and runbooks
SOC triage notes and case histories, de-identified
Penetration test methodologies and de-identified findings
Threat intelligence reports you authored
Training labs, capture-the-flag challenges and test environments
Why buyers want them: Security work is a sequence of observations, tool calls and decisions, the same structure as an agent trajectory. AI labs also buy replayable environments, and training labs and challenge sets can become RL environments.
Published buyer range: $20,000 to $750,000 per companyMercor's published listing for cybersecurity companies, recorded by ddiy.co, checked October 2026
Size buyers look for: 20 to 2,000 staff (Mercor)
Rights issues to clear: EAR controls on intrusion software (ECCNs 4D004 and 4E001.c), with License Exception ACE limits by destination and end user
Intelligence received under TLP:RED, TLP:AMBER+STRICT or TLP:AMBER cannot be passed to a buyer
Client penetration test and incident reports are confidential to the client
Logs carry IP addresses, which the CCPA lists among personal information identifiers
Malware samples and third-party tools are not yours to license
UK and EU: UK export control entries 4D004 and 4E001.c, and UK GDPR online identifiers

Why cybersecurity companies work with us

1
AI buyers publish ranges of $20,000 to $750,000 per company for cybersecurity companies records. We tell you in one consultation where yours are likely to land.
2
Every buyer we introduce passes five checks, including company identity, intended use and security, before seeing even a redacted sample of your records.
3
You pay nothing unless a deal completes. Our success fee is agreed in writing before we introduce you to any buyer.
4
Your raw data never passes through us. You sign a license directly with your chosen buyer, after your own lawyer has reviewed it.

Book a consultation

Cybersecurity firms produce records that match two formats AI labs buy. Agent trajectories log observations, tool calls and results, and replayable environments let a model attempt a task and be scored. A SOC analyst's case history and a training lab are those formats in working form.

How much do AI companies pay for cybersecurity data?

AI companies pay cybersecurity firms $20,000 to $750,000 per company, according to Mercor's published listing, for firms with 20 to 2,000 staff. ddiy.co recorded the range from Mercor's referral page in October 2026.

The floor matches the $20,000 starting point Mercor gives for agencies, call centers and AI product companies. Where a firm lands depends on volume, how much of the material is its own work rather than client material, and how cleanly it can be de-identified.

What cybersecurity data do AI companies buy?

AI companies buy cybersecurity data that captures analyst reasoning and repeatable tasks. The table sets out the common record types and the issue each raises.

Cybersecurity records and their main issue
Record	Format a buyer sees	Main issue
Detection rules and queries	Code with intent and test cases	Low if written in-house
IR playbooks and runbooks	Procedural knowledge	Client-specific details
SOC case histories	Agent trajectories	IP addresses, usernames and client identity
Penetration test findings	Expert reasoning on real systems	Client confidentiality and open vulnerabilities
Threat intelligence	Analysis text	TLP labels and source restrictions
Training labs and challenges	RL environments	Exploit code and export controls

A lab with tasks that can be reset, attempted and scored automatically is an RL environment in all but name.

Do export controls apply to security data?

Export controls can apply to security data that includes exploit tooling. The Bureau of Industry and Security's final rule on cybersecurity items, effective May 26, 2022, covers intrusion software items such as ECCNs 4D004 and 4E001.c and created License Exception Authorized Cybersecurity Exports (ACE) at 15 CFR 740.22.

ACE authorizes exports, reexports and in-country transfers of cybersecurity items, including deemed exports, but not to Country Group E:1 or E:2 destinations, and it restricts certain government and other end users in Country Groups D:1 to D:5. The rule also notes that vulnerability disclosure and cyber incident response are excluded from control under 4E001.a and .c, so detection content and IR records carry less export risk than offensive tooling. A training lab built around working exploits needs a specialist export control view before it goes to a buyer with foreign staff.

Can you license threat intelligence you received from others?

You can license threat intelligence you received from others only if the source allows it. Under FIRST's Traffic Light Protocol version 2.0, TLP:RED is for named recipients only, TLP:AMBER+STRICT stays within your organization, TLP:AMBER may go to your organization and its clients on a need-to-know basis, and TLP:GREEN stays within your community.

Only TLP:CLEAR material may be passed on without limit, subject to copyright. Feeds bought from vendors carry their own license terms. License your own analysis and remove anything received under a sharing agreement.

What other rights issues apply to cybersecurity data?

Client reports are the main contractual issue. Penetration test and incident response reports describe a named client's systems and weaknesses, and engagement terms usually make them confidential. Removing the client's name does not always remove the risk, because system details can identify an organization.

Logs and case notes carry IP addresses, hostnames and usernames. The CCPA, at California Civil Code section 1798.140(v)(1)(A), lists an Internet Protocol address among the identifiers that count as personal information, so treat log data as personal information until it is de-identified.

If you hold UK or EU data

UK firms face the UK Strategic Export Control List, consolidated in December 2025, which controls intrusion software tooling under entry 4D004 and development technology under 4E001.c, and notes that 4E001.c does not control vulnerability disclosure or cyber incident response. UK GDPR Article 4(1) lists an online identifier as a way a person can be identified.

How do you sell cybersecurity data through Sell My Data To AI?

We start with a consultation. We do not take custody of your raw data, and full data moves only after you sign a license directly with the buyer.

Every buyer is verified for intended use, security and retention commitments and onward transfer limits before seeing a sample, which matters when material describes attack techniques. Book a consultation to find out what your records are worth.

Frequently asked questions

How much does Mercor pay cybersecurity companies?

Mercor's published listing puts cybersecurity company payouts at $20,000 to $750,000 per company, for firms with 20 to 2,000 staff, as recorded by ddiy.co in October 2026. Firms with in-house detection content, playbooks and de-identified case histories have the most material that can be licensed without client consent.

Can we sell penetration test reports?

You can rarely sell penetration test reports as they stand, because they describe a named client's systems and are confidential under the engagement terms. Your methodology, report templates and fully de-identified findings are a better basis. Check each contract and take independent legal advice before including client material.

Does TLP:GREEN intelligence count as shareable?

TLP:GREEN intelligence may be shared with peers and partner organizations in your community, but not through publicly accessible channels and not outside the community, according to FIRST's TLP 2.0 definitions. Licensing it to an AI company falls outside that. Only TLP:CLEAR material may be passed on without limit.

Are capture-the-flag challenges worth anything to AI labs?

Capture-the-flag challenges and training labs can become RL environments, which AI labs buy alongside agent trajectories. Value depends on whether tasks are replayable, scored automatically and documented. Check EAR controls on any exploit code, and see our guide to agent trajectories and RL environments.

Sources

How to sell company data to AI companies (2026 guide), ddiy.co, accessed November 2026
Information security controls: cybersecurity items (final rule, 87 FR 31948), Bureau of Industry and Security, Federal Register (govinfo.gov), accessed November 2026
Traffic Light Protocol (TLP), FIRST, accessed November 2026
California Civil Code section 1798.140: definitions (CCPA), California Legislative Information, accessed November 2026
UK Strategic Export Control List, December 2025, GOV.UK (Export Control Joint Unit), accessed November 2026
UK GDPR Article 4: definitions, legislation.gov.uk, accessed November 2026

Book a free consultation for your firm

Tell us what you hold and when suits you. In 30 minutes we cover likely buyer interest, a realistic range and any rights issues to clear first. No records leave your systems.

Related guides

Agent trajectories and RL environments explained
Data types
How to sell source code to AI companies
Selling data
De-identification for AI training data
Legal and compliance
What data do AI companies buy?
Selling data
Is selling company data to AI safe? The real risks
Legal and compliance
How much is your data worth to AI companies?
Pricing and value