debeers

This is incidental, but there are important activities that gotten harded for me in recent years - just as OP described. It's pretty bold to blame just lack of motivation or commitment.

It's a crude weapon... for a less civilized age.

You can't. It still phones home a lot, even at the lowest telemetry settings. The only edition where you can disable it is LTSB and even there it is hidden in Local Group Policy Editor.

Yara is used to find file system artifacts https://virustotal.github.io/yara/

Initially I advertised among friends and former co-workers that I knew needed this kind of service for their own infrastructure. They became my first customers pretty much right away, but my first organic users came couple months later. I marketed primarily by writing articles on LinkedIn.

For the second part of the question - I'd say do some original research and publish it. Hang out where other security people are. Still, the easiest way is to build street cred and professional network while you work for someone else.

I run one-man security consulting business. Pays well enough to live comfortably and provides enough free time to work on side-projects.

Six months ago I started transitioning from service to product oriented approach with online vulnerability scanning service https://getroot.sh aimed at network administrators and webmasters.

I have another product targeted at penetration testers in works, to be released in couple of months.