I've run a security consultancy for 5 years and stopped few years ago. The goal was lifestyle business, not something operating at scale or doing snake oil. The focus was on high quality audits (for specific platforms such as Rails) that others wouldn't be able to perform.

I did many things wrong but still pretty happy with the results. Not a recommendation: I did zero marketing.

Monthly some cool bugs I did writeups about, which brought new clients, which brought new ideas, which I wrote up about again.

I quickly realized that (cringe) "rock star" name allows you to bill $500/hr, which I did. No one ever said "that's too expensive for us".

I think what tptacek and McKenzie are always saying is best advice indeed : increase your rates. Believe that you are worth that much, don't feel like an imposter.

The reports I've delivered contained great bugs but were poorly presented (no design, basic formatting). It could be done much nicer, so invest in your "receivable items".