That last point strikes me as a very valuable piece of information which I've never seen spelled out before: consultants/freelancers should specialize in a vertical.

(I'm reading between the lines to assume that you don't actually have a problem with teams standardizing around a specific stack, but rather that they shouldn't market themselves that way; either way, that's not really the interesting part.)

There are a lot of clients (USG, in particular, and anyone who contracts for them) who must do hourly or 15-minutely reporting (and essentially always to bill on the same terms, but sometimes you can bill daily and report more granularly).

Your counterargument is going to be "don't do government stuff" I'm sure.

Don't do government work.

That's a rule that has served us in pretty good stead.

It's not just the moral issue (though I do have dealbreaking moral problems with doing the kind of work I do for the USG) but also that the market for GSA-style services is so different than the regular market; not only is it harder and weirder to address as a market, but also succeeding there doesn't teach you much about how to make your offerings work in the real market.

(I've worked, earlier in my career, on somewhat large-scale projects [not in vuln research] serving government agencies, but have never been a principal at a company that targeted government sales, so, grain of salt or whatever).

Counterpoint:

GSA products sales aren't so bad, and sometimes services are incidental to product sales. If I were a lock maker, I'd sure want to be Kaba-Mas or S&G with a decent amount of government sales. If you have to provide some services, it's not horrible -- it's a $200-400k/yr living for a few consultants if you're in the right space, and generates nice revenue for the company, without taking over the focus. If you're an independent contractor and end up subcontracting to a product company, you can make really good money filling this role. If you don't have to do the "get the product sold" phase, and are purely subcontracted to the the implementation/support, it's actually not bad, and not very different from enterprise clients in general. There is the problem of single-client-all-revenue, and some slightly odd work rules, but enterprise often has that.

I share your moral concerns about vuln research/etc. for the government, but I have no problem with defensive tech for them, or for non-security tech.

Charging by the day or week is something that's come up a couple of times. How do you come up with the daily rate? Is it the total of what you'd charge per hour for eight hours?