# How cybersecurity companies can sell data to AI companies

URL: https://sellmydatatoai.net/sell-your-data/cybersecurity-companies

Cybersecurity companies can license detection rules, incident response playbooks, SOC triage notes, de-identified penetration test findings and training lab environments to AI companies. Mercor's published listing puts cybersecurity company payouts at $20,000 to $750,000 for firms with 20 to 2,000 staff. Threat intelligence shared under TLP restrictions, client findings and export-controlled tooling need clearing first.

## Key takeaways

- AI buyers most want these records from cybersecurity companies: (1) detection rules, signatures and queries your team wrote, (2) incident response playbooks and runbooks and (3) SOC triage notes and case histories, de-identified.
- Published buyer range for cybersecurity companies: $20,000 to $750,000 per company.
- Source: Mercor's published listing for cybersecurity companies, recorded by ddiy.co, checked October 2026.
- Size buyers look for: 20 to 2,000 staff (Mercor).
- The first rights issue to clear: EAR controls on intrusion software (ECCNs 4D004 and 4E001.c), with License Exception ACE limits by destination and end user. This page covers 5 more.
- Sellers pay nothing to be assessed. We charge a success fee only when a deal completes, and the fee is agreed in writing before we introduce you to any buyer.

## At a glance

- Records buyers ask for: Detection rules, signatures and queries your team wrote; Incident response playbooks and runbooks; SOC triage notes and case histories, de-identified; Penetration test methodologies and de-identified findings; Threat intelligence reports you authored; Training labs, capture-the-flag challenges and test environments
- Why buyers want them: Security work is a sequence of observations, tool calls and decisions, the same structure as an agent trajectory. AI labs also buy replayable environments, and training labs and challenge sets can become RL environments.
- Published buyer range: $20,000 to $750,000 per company (Mercor's published listing for cybersecurity companies, recorded by ddiy.co, checked October 2026)
- Size buyers look for: 20 to 2,000 staff (Mercor)
- Rights issues: EAR controls on intrusion software (ECCNs 4D004 and 4E001.c), with License Exception ACE limits by destination and end user; Intelligence received under TLP:RED, TLP:AMBER+STRICT or TLP:AMBER cannot be passed to a buyer; Client penetration test and incident reports are confidential to the client; Logs carry IP addresses, which the CCPA lists among personal information identifiers; Malware samples and third-party tools are not yours to license; UK and EU: UK export control entries 4D004 and 4E001.c, and UK GDPR online identifiers

Cybersecurity firms produce records that match two formats AI labs buy. [Agent trajectories](https://sellmydatatoai.net/buy-ai-training-data/agent-trajectory-data) log observations, tool calls and results, and replayable environments let a model attempt a task and be scored. A SOC analyst's case history and a training lab are those formats in working form.

## How much do AI companies pay for cybersecurity data?

AI companies pay cybersecurity firms $20,000 to $750,000 per company, according to Mercor's published listing, for firms with 20 to 2,000 staff. ddiy.co recorded the range from Mercor's referral page in October 2026.

The floor matches the $20,000 starting point Mercor gives for agencies, call centers and AI product companies. Where a firm lands depends on volume, how much of the material is its own work rather than client material, and how cleanly it can be de-identified.

## What cybersecurity data do AI companies buy?

AI companies buy cybersecurity data that captures analyst reasoning and repeatable tasks. The table sets out the common record types and the issue each raises.

| Record | Format a buyer sees | Main issue |
| --- | --- | --- |
| Detection rules and queries | Code with intent and test cases | Low if written in-house |
| IR playbooks and runbooks | Procedural knowledge | Client-specific details |
| SOC case histories | Agent trajectories | IP addresses, usernames and client identity |
| Penetration test findings | Expert reasoning on real systems | Client confidentiality and open vulnerabilities |
| Threat intelligence | Analysis text | TLP labels and source restrictions |
| Training labs and challenges | RL environments | Exploit code and export controls |

A lab with tasks that can be reset, attempted and scored automatically is an [RL environment](https://sellmydatatoai.net/glossary/rl-environment) in all but name.

## Do export controls apply to security data?

Export controls can apply to security data that includes exploit tooling. The Bureau of Industry and Security's final rule on cybersecurity items, effective May 26, 2022, covers intrusion software items such as ECCNs 4D004 and 4E001.c and created License Exception Authorized Cybersecurity Exports (ACE) at 15 CFR 740.22.

ACE authorizes exports, reexports and in-country transfers of cybersecurity items, including deemed exports, but not to Country Group E:1 or E:2 destinations, and it restricts certain government and other end users in Country Groups D:1 to D:5. The rule also notes that vulnerability disclosure and cyber incident response are excluded from control under 4E001.a and .c, so detection content and IR records carry less export risk than offensive tooling. A training lab built around working exploits needs a specialist export control view before it goes to a buyer with foreign staff.

## Can you license threat intelligence you received from others?

You can license threat intelligence you received from others only if the source allows it. Under FIRST's [Traffic Light Protocol](https://www.first.org/tlp/) version 2.0, TLP:RED is for named recipients only, TLP:AMBER+STRICT stays within your organization, TLP:AMBER may go to your organization and its clients on a need-to-know basis, and TLP:GREEN stays within your community.

Only TLP:CLEAR material may be passed on without limit, subject to copyright. Feeds bought from vendors carry their own license terms. License your own analysis and remove anything received under a sharing agreement.

## What other rights issues apply to cybersecurity data?

Client reports are the main contractual issue. Penetration test and incident response reports describe a named client's systems and weaknesses, and engagement terms usually make them confidential. Removing the client's name does not always remove the risk, because system details can identify an organization.

Logs and case notes carry IP addresses, hostnames and usernames. The CCPA, at California Civil Code section 1798.140(v)(1)(A), lists an Internet Protocol address among the identifiers that count as personal information, so treat log data as personal information until it is [de-identified](https://sellmydatatoai.net/glossary/de-identification).

> **License your work, not your clients' secrets** Rules, playbooks, methods and labs you built are the cleanest assets. Client findings, received intelligence and working exploits each need a separate decision.

## If you hold UK or EU data

UK firms face the [UK Strategic Export Control List](https://assets.publishing.service.gov.uk/media/69415ba1f065108822537524/uk_export_control_list_2025.pdf), consolidated in December 2025, which controls intrusion software tooling under entry 4D004 and development technology under 4E001.c, and notes that 4E001.c does not control vulnerability disclosure or cyber incident response. UK GDPR Article 4(1) lists an online identifier as a way a person can be identified.

## How do you sell cybersecurity data through Sell My Data To AI?

We start with a consultation. We do not take custody of your raw data, and full data moves only after you sign a license directly with the buyer.

Every buyer is verified for intended use, security and retention commitments and onward transfer limits before seeing a sample, which matters when material describes attack techniques. [Book a consultation](https://sellmydatatoai.net/book-a-consultation?side=seller) to find out what your records are worth.

## Frequently asked questions

### How much does Mercor pay cybersecurity companies?

Mercor's published listing puts cybersecurity company payouts at $20,000 to $750,000 per company, for firms with 20 to 2,000 staff, as recorded by ddiy.co in October 2026. Firms with in-house detection content, playbooks and de-identified case histories have the most material that can be licensed without client consent.

### Can we sell penetration test reports?

You can rarely sell penetration test reports as they stand, because they describe a named client's systems and are confidential under the engagement terms. Your methodology, report templates and fully de-identified findings are a better basis. Check each contract and take independent legal advice before including client material.

### Does TLP:GREEN intelligence count as shareable?

TLP:GREEN intelligence may be shared with peers and partner organizations in your community, but not through publicly accessible channels and not outside the community, according to FIRST's TLP 2.0 definitions. Licensing it to an AI company falls outside that. Only TLP:CLEAR material may be passed on without limit.

### Are capture-the-flag challenges worth anything to AI labs?

Capture-the-flag challenges and training labs can become RL environments, which AI labs buy alongside agent trajectories. Value depends on whether tasks are replayable, scored automatically and documented. Check EAR controls on any exploit code, and see our guide to [agent trajectories and RL environments](https://sellmydatatoai.net/guides/agent-trajectories-and-rl-environments).

## Sources

- [How to sell company data to AI companies (2026 guide)](https://ddiy.co/sell-company-data-to-ai/), ddiy.co, accessed November 2026
- [Information security controls: cybersecurity items (final rule, 87 FR 31948)](https://www.govinfo.gov/content/pkg/FR-2022-05-26/html/2022-11282.htm), Bureau of Industry and Security, Federal Register (govinfo.gov), accessed November 2026
- [Traffic Light Protocol (TLP)](https://www.first.org/tlp/), FIRST, accessed November 2026
- [California Civil Code section 1798.140: definitions (CCPA)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.140.&lawCode=CIV), California Legislative Information, accessed November 2026
- [UK Strategic Export Control List, December 2025](https://assets.publishing.service.gov.uk/media/69415ba1f065108822537524/uk_export_control_list_2025.pdf), GOV.UK (Export Control Joint Unit), accessed November 2026
- [UK GDPR Article 4: definitions](https://www.legislation.gov.uk/eur/2016/679/article/4), legislation.gov.uk, accessed November 2026

---

Book a free consultation: https://sellmydatatoai.net/book-a-consultation