I think this is not the best idea because the process is not knows nor documented, such hackery by anonymous parties I have every day, and I have hordes of them, and I cant believe somebody wants even more money to pay to actually get hacked. I got 100 page report every day from all sorts of hacks.
The trick is if I send you my vm image, if you can make it secure and send me it back, you can't make it, because you would require a specific product, and you dont have a product, procedure or anything like this and offer only "hackery", which is very easy to do, obviously you can hack into any LAMP and Windows server and this is nothing really revealing only except how much damage you can really make. So you could say simply: "you are not having enough security to not be crowd hacked".
It would be much better, if you would actually utilize some sort of process like SDL, which would include securing the application, so for this I could spend £100 per month per vm image, and it would have to be bullet-proof including auto-learning and updates, and the test environment for hacking and security tests, with sync from my SVN, and that would include 3rd party patch review and DDoS testing, mailbox abuse, brute-force, the performance report and load tests stats and it would include Network, System and Application, plus the DNS, LDAP and Mail and whatever specific there is.
I dont know any website doing anything like this with these methods, but "these" methods fit in SDL at the two or three last stages, so in order to professionally utilize it that would require all stages, documented, and implemented, which would be a very complex problem, maybe standard LAMP and Windows would be OK to start with.
It fits also with government - you might get a mission which includes hacking into national power and nuclear infrastructure, this way you could test definitely the NHS, but not banks, and definitely you should try with army. If you can make it, you can make it make sense, because for business this is not the most useful thing, because businesses can make this themselves which is more secure, and legally enforced.