Addressing legal entities for a cybersecurity services provider (CSSP) who wish to offer additional services and structure.

Fantastic news! We've Found the answer you've been seeking!

Question:

Please assist in addressing the liability with forming additional companies (legally) for Company A.

Company A background: Company A has found that they hold a lot more services they are qualified to offer than just traditional security consulting. They do not want to limit themselves and are thinking long-term. Should the company do this all under Company A? Or should they create a Company A Group of related companies, or of fully separate entities? If they make it look like separate companies for segmented marketing, should it be all separate LLCs, or should they just do DBAs ("doing business as" company aliases, they already know they like those)? What should the ownership structure be? Right now, the CEO owns the company outright. Different team members can provide different services.Should they own separate-but-related companies? How should those who are not CEO and founder get paid? How much should CEO keep? (It was suggested "none, ever," and there was broad support for this idea, but CEO and his partner are against it)

Cybersecurity:Company A has discovered that one of their employees, C, has open source and dark web investigation skills and has suggested they could also do what they considered "rudimentary cybersecurity checks." Well, as it turns out of what employee C considers rudimentary would many potential clients identify as an unsettling number of easily fixed vulnerabilities. So far, Company A has put all of that under the basic threat vulnerability assessment umbrella, but employee C can offer more in the way of cybersecurity consulting. Employee C has also brought in someone, employee F, who can provide full ethical hacking and penetration testing.
Tactical Training: Some of Company A's employees are very experienced at training tactical skills (shoot, move, communicate, and treat) in the military. The CEO has received official certification to do so, and a couple other employees may, also. This requires additional insurance above and beyond regular business liability, but it could be a real benefit to the organizations for whom we consult.
Global Mobility Services: Company A is also able to help organizations who are preparing to send people overseas for short-term or long-term assignments. Employee E completed a doctoral dissertation on how to select, prepare, support, and reintegrate people who go overseas to work closely with people from another culture. Company A also has several employees who can provide intelligence on the working environment, culture, and any safety and security concerns in the target country.These are regular services that global mobility consulting companies provide, but Company A can offer it at lower cost for smaller scale organizations and even educate them how to do much of it themselves.
Strategy, Change Management, Research, and Problem-Solving: Employee E DBA and work experience have enabled them to provide some traditional business consulting services, and several other employees at Company A have skills they can contribute to this area as well.