My first startup was exactly in this space. We topped out at $500K/year before the 2009 recession trashed our client roster. I'd be happy to discuss what worked for us.
A few years back, a blog written by hackers emerged on the Romanian market. Back then, I was working as a web developer for the biggest jobs site on our market (>3M revenue). One morning, we got an email from the guy who started the hacker blog. It was a simple SQL injection that revealed a lot ...