How to Start a Security Company in 2026: Licensing, Operations, and Growth

The first thing nobody tells you about starting a security company is that the licensing paperwork is the easy part. The hard part is gross margin. You will sign your first contract somewhere between $28 and $42 an hour, you will pay your guards somewhere between $18 and $24 an hour, and after workers' comp, payroll tax, uniforms, equipment, scheduling overhead, and the inevitable no-call-no-show coverage at 2:00 AM, the spread that looked like 40% on the bid sheet ends up closer to 17% on the P&L.

That is the business. Anyone who tells you otherwise is selling a course. The good news is that the industry has real demand, recurring contracts, predictable cash flow, and a customer base that values reliability over price more than almost any other services vertical. The operators who do well are not the ones with the lowest bid. They are the ones who can prove guards showed up, posts got walked, incidents got documented, and the client portal updated overnight without anyone calling dispatch.

This guide is written for the person who already knows the work — a former site supervisor, an ex-LEO, a corporate security director going independent — and is trying to figure out the business side. State licensing in 2026, insurance you actually need (not what the broker upsells), the bill-vs-pay rate math, the software stack that runs a 5-50 guard operation, and a realistic 12-month revenue path.

Most new agencies pick one or two lanes, not all five. Each has a different licensing burden, insurance profile, gross margin shape, and sales cycle.

If you are reading this and you are an operator going independent, the realistic starting lane is unarmed guard services with a mobile patrol layer on top. It is the lowest capital outlay, the most addressable demand, and the path that builds the operational muscle (scheduling, dispatch, payroll, reporting) you need before you graduate into armed work or EP. The rest of this guide assumes that path.

There is no federal security agency license. Every state runs its own regulator, its own exam, its own bond requirement, its own continuing education rules. The bad news is that this fragmentation means you cannot just download a checklist. The good news is that once you are licensed in your home state, you have a defensible moat — out-of-state competitors face the same friction expanding into your market.

Most states require a Private Patrol Operator (PPO) license or Security Agency license held by a qualifying manager (QM) — a named individual on the application who personally meets the experience and exam requirements. In California, this is the BSIS PPO license, requiring a qualified manager with at least one year of compensated security experience (2,000+ hours), a $3,000 surety bond, fingerprinting through Live Scan, and the QM exam. In Oregon, DPSST handles licensing and requires the QM to pass the executive manager exam. In Texas, the regulator is DPS (Department of Public Safety) and the Company License A application carries different experience and insurance thresholds. In Florida, the Class B Security Agency License is administered through the Department of Agriculture and Consumer Services (yes, agriculture — Florida is its own thing).

The pattern across most states: 1-3 years of documented industry experience for the QM, a written exam, a surety bond in the $2,000-25,000 range, fingerprinting, and proof of insurance at application. Application processing runs 30-120 days depending on the state and how clean the background check is. Plan on 90 days from filing to operating license in hand.

Separate from the agency license, every guard you employ needs their own credential. California issues the BSIS Guard Card after 8 hours of pre-assignment training, fingerprinting, and a $50 application fee. Within 30 days of assignment, the guard must complete an additional 16 hours of Power-to-Arrest training, then 16 more hours within six months — 40 hours total in year one. Oregon DPSST requires unarmed officer certification with 14 hours of classroom plus passing the state exam. Texas DPS issues the Level II Non-Commissioned Officer license with 6 hours of training and a state test. New York requires the 8/16/8 sequence (8 hours pre-assignment, 16 hours on-the-job, 8 hours annual in-service).

For your operation, this matters in two specific ways. First, you cannot put a guard on post until their card is active — which means your hiring pipeline has a 2-4 week lead time, not the same-week you might be used to in other services trades. Second, training renewal is a recurring compliance task, and missing a renewal means the guard is on the schedule but technically not legal to deploy. This is exactly the kind of thing that should live in your HR app with automated expiration reminders 30/60/90 days out.

If you go armed, every armed officer needs a separate state firearms permit on top of their guard card. In California, that is the BSIS Firearms Permit — eight hours of range training per caliber, written exam, qualification shoot every two years, and a permit fee. Most other states have an equivalent track. Federal background checks, prohibited person screening, and in some states an interview component.

At the operator level, armed work also means you carry a higher general liability limit, higher umbrella coverage, and tighter post orders. The math on armed work is better, but the failure mode is much worse, and the operators who survive in the armed lane have written use-of-force policies, documented training records, and incident review protocols that exist before they need them — not after.

Your broker will quote you a package. Your contracts will dictate what you actually need. Most commercial contracts in 2026 require a security vendor to carry the following at minimum, and many enterprise or government contracts will demand higher limits.

Two practical notes on insurance. First, do not bid contracts you cannot insure. A common rookie mistake is signing a deal that requires $5M/$10M coverage when your policy is $1M/$2M, then scrambling to upgrade mid-contract while the underwriter asks uncomfortable questions about loss history. Second, your workers' comp class code matters more than most operators realize — armed (NCCI 7720) carries a materially higher rate than unarmed clerical-adjacent codes, and misclassifying a single guard on payroll can blow up at audit. Talk to a broker who specializes in security; the generalist commercial broker will quote you generic premiums that miss the industry-specific savings.

This is the single most important piece of math in the business, and the one most new operators get wrong. Your gross margin is not the difference between bill rate and pay rate. It is bill rate minus pay rate, minus burden (workers' comp, payroll tax, unemployment insurance, benefits, uniforms, equipment, training time), minus your share of overhead, minus the inevitable shrinkage from no-shows, call-outs, and post coverage gaps.

These numbers will move in your market — California pay rates are higher, Texas pay rates are lower, Florida workers' comp on armed runs hotter than the national average. But the shape holds. A 30-35% headline gross margin on the bid sheet becomes a 15-25% real gross margin once burden lands, and net contribution after overhead lives in the low double digits.

Which means three things. One, every hour billed but unpaid (client dispute, billing error, time-card adjustment) wipes out the margin on 4-5 other hours. Two, every unbilled hour worked (showing up early, staying late, training time you forgot to bake into the rate) is pure loss. Three, you cannot afford a sloppy time-and-attendance system. A guard who clocks in 10 minutes early every shift over a 50-guard, 40-hour operation costs you roughly $30,000 a year in unbilled labor.

Once contracts are signed and guards are licensed, the operation lives or dies on eight repeatable processes. Every operator runs all eight. The ones who run them well do it inside a single system instead of across spreadsheets, group texts, and a notebook on the dispatcher's desk.

A 5-guard agency can run on paper, group texts, and a shared Google Sheet for about four months before it breaks. A 15-guard agency cannot. The classic small-security stack stitches together a CRM for prospects, a dispatch tool for assignments, a separate time-tracking app with GPS, a forms tool for incident reports, a portal product for clients, an invoicing tool, and a payroll system. Each one is its own login, its own bill, its own integration to babysit.

The consolidated alternative is to run the whole operation on one platform where customer data, shift data, time data, and billing data live in the same database. That is the Deelo angle — but the same logic applies whatever platform you choose. The question to ask of any tool is whether it can talk to the others without a Zap that breaks at 3 AM.

Here is how the workflow maps onto Deelo's apps for a security operator:

The reason consolidation matters in security specifically is data flow. A new contract in CRM should create the site record in Field Service so the dispatcher can schedule against it. A new guard hire in HR should generate the time-tracking profile and surface in the eligible-to-dispatch pool only after the guard card is verified. An incident logged in Forms should attach to the site record, route to the client portal, and show up on the next invoice as a billable event if the contract allows. Across seven separate tools, every one of those handoffs is an integration to maintain. Across one platform, they are not — the data is already shared.

Outbound only works in security if you have a credible operational story. Cold-emailing a property manager from a brand-new agency with no insurance certificate and no client list will not move the needle. The accounts that close in your first 90 days are the ones where you have a relationship, an industry-specific angle, or a referral from someone the buyer already trusts.

Five lanes that consistently produce early contracts for new agencies:

Every founder wants the hockey-stick year-one. The realistic year-one for a new security agency, run well, looks closer to a staircase. The constraints are real — you cannot bill until you are licensed, you cannot deploy a guard until their card is active, you cannot scale dispatch faster than your operational systems can absorb. Here is a plausible 12-month path for an operator going from zero to a small functioning agency in a mid-sized metro.

Year-one revenue in the $1.0M-$2.5M range is achievable for an operator with relevant industry relationships and disciplined operations. Year-one net is usually thin — in the 5-12% range — because you are absorbing licensing costs, insurance premiums paid in advance, software setup, and the lumpiness of payroll outflow against weekly invoice inflow. The agencies that survive year one and compound into year two are not the ones with the most contracts. They are the ones whose contracts renew because the operation actually worked.

Twenty-five guards across twelve contracts. Every guard's card and training renewals tracked with 90-day advance reminders. Every site has a written post order accessible on the guard's phone. Geofenced clock-in with photo verification at shift start, GPS-confirmed checkpoint hits during the shift, end-of-shift DAR generated automatically and delivered to the client portal by 8 AM the next day. Incident reports filed on a phone, attached to the site record, visible to the client within an hour. Weekly invoices generated from time-tracking data, no manual reconciliation. A single login for the dispatcher that shows live coverage across every site. AR under 35 days. Workers' comp audit clean. No surprise OT.

That is a $2M-$3M agency running on the operational systems that should have been in place at $500K. The operators who build it that way at the start are the ones who can scale to $5M-$10M without a re-platform.

The security industry rewards operators who treat the back office like a product. Licensing is a checkbox. Insurance is a line item. The actual edge is whether your dispatch board is accurate at 3 AM, whether your DARs land in the client portal before the property manager checks email, whether your guard cards renew on schedule, and whether your contracts renew because the operation worked — not because the client is too busy to switch. Get those four right in year one and the rest of the business compounds.