I disagree. InfoSec has these companies who hire #3, thinking they can underpay, and it's given the whole industry a bad name because of the shoddy work and dubious claims they make. They go in and play pass the hash, charge a lot, and the company is really no better off.

No offense, but do you think the fact that you have made multiple attempts and not yet created a company that has become a prominent name in the industry means that your approach may not be working?