As someone who ran a security firm. Results are much difficult to show/prove in a security firm. Running a development agency, we can break down the project into tasks and the stackholder can review each step from our worklog. Usually, they are happy with the result. I've found the best way to run a development agency is not hire in range of 400-500 developers. This has some trade offs like some devs are not happy when we switch them from project 1 to project 10 just because stackholder lost interest or their funding dried up.