Getting started with QuoteCloud

Security reports and remediation quotes, drafted from your findings

Turn a scanner export into a branded report and a remediation quote priced from the findings, drafted by your AI assistant for an analyst to review, then signed and paid.

Start free 14-day trial Book a demo

QuoteCloud is document, quoting and eSignature software for security firms. Scan, test and monitoring data becomes branded reports, and a Spreadsheet block prices remediation from the findings. With QuoteCloud's MCP service, your AI assistant can be set up to draft the report and the quote for an analyst to review. Clients sign and pay on signing.

Last reviewed by the QuoteCloud team

An engineered drawing of a fictional client's office, Tessaly Logistics: two server racks, the remote access gateway, the customer portal server, desks, two depot PCs and a label printer, with network runs on the floor. Five numbered callouts mark the assets with findings: the remote access gateway and the database server (critical), the customer portal, the label printer and the depot PCs (high). A green line runs from the core switch to the scanner's export, a stack of sheets beside the office. Below, two cards from a fictional security firm, Northlatch Security: the October scan report, with 2 critical, 7 high, 18 medium and 31 low findings and an AI-drafted summary that turns from 'Drafted by AI, review' to 'Summary accepted'; and the remediation quote priced from the findings: fix 2 critical findings, est. 12 hours, $2,220; 7 high-severity findings, 21 hours, $3,885; 18 medium-severity findings, 27 hours, $4,995; coordination and retest $2,338; total $14,781.80 inc tax, which turns from a draft for review to signed with a 30% deposit of $4,434.54 paid.

Try it: from a scanner export to a signed remediation quote

Pick a sample client, ask the assistant to draft, then review as the analyst would: accept the summary, correct a false positive and watch the price follow. Then send it, sign and pay the deposit as the client.

  1. 1Export
  2. 2AI drafts
  3. 3Analyst review
  4. 4Sent
  5. 5Signed & paid

Your scanner's exportFictional sample data

tessaly-ext-int-2026-10-14.csv

Findings by severity in the export
severityfindingslast month
critical24
high710
medium1821
low3129

External and internal scan · 212 assets · run Wed 14 Oct

Your AI assistantConnected through QuoteCloud's MCP service

Dev“Draft October's scan report for Tessaly Logistics from this export, and a remediation quote from the findings. Leave both as drafts for me.”

  1. Find Tessaly Logistics in your client listMCP
  2. Create the scan report from your “Monthly scan report” template, as a draftMCP
  3. Write the executive summary from the export, flagged for reviewMCP
  4. Create the remediation quote from your template, as a draftMCP
  5. Write the export's finding counts into the quote's Findings tabZapier

Two drafts for Dev Kapoor to review. Nothing is sent without a person.

Ask the assistant to draft, and the two drafts open here.

Northlatch SecurityMonthly vulnerability scan reportNL-VS-2611Demo · fictional data

Executive summary October 2026 · Tessaly Logistics

  • Critical2−2 since last
  • High7−3 since last
  • Medium18−3 since last
  • Low31+2 since last
Scope
External and internal scan · 212 assets
Source
Your scanner's export, run Wed 14 Oct
Drafted by AI · review Summary accepted

Tessaly Logistics, external and internal scan · 212 assets: 2 critical, 7 high, 18 medium and 31 low findings, with 9 critical or high open against 14 last month. We recommend fixing the critical findings this week and the high findings within 14 days; the remediation quote prices both.

Northlatch SecurityTessaly LogisticsNL-Q-2614Demo · fictional data

Findings tab

Counts from the export: check them, and correct any false positive.

Remediation pricing.xlsxSpreadsheet block
E2 =D2*$C$7

Findings

RowABCDEF
1 Severity Findings Hours each Hours Line price Line description
2 Critical 6 12 $2,220 Fix 2 critical findings · est. 12 h
3 High 3 21 $3,885 Fix 7 high-severity findings · est. 21 h
4 Medium 1.5 27 $4,995 Fix 18 medium-severity findings · est. 27 h
5 Low 0.5 15.5 $2,867.50 Clean up 31 low-severity findings · est. 15.5 h
6 Coordination 8% $888 Change control & coordination
7 Engineer rate /h $185 Northlatch's rate card
8 Quote total Price table$14,781.80 Brought back from the price table
9 Per finding fixed $547.47 Estimate
  • Counts typed in or written by Zapier
  • Your assumption
  • Estimate
  • Connected to the price table

Priced from the findings Editor view · link chips show where each line comes from

ItemQtyRateAmount
Fixes$11,988
Fix 2 critical findings · est. 12 hF-01, F-02 · this week
Description ← Findings!F2 Unit price ← Findings!E2 		1 lot $2,220 $2,220.00
Fix 7 high-severity findings · est. 21 hF-03 to F-05 and four more
Description ← Findings!F3 Unit price ← Findings!E3 		1 lot $3,885 $3,885.00
Fix 18 medium-severity findings · est. 27 hGrouped by system, within 30 days
Description ← Findings!F4 Unit price ← Findings!E4 		1 lot $4,995 $4,995.00
Change control & coordinationChange requests, out-of-hours windows, sign-off
Unit price ← Findings!E6 		1 lot $888 $888.00
Options Tick to add
Description ← Findings!F5 Unit price ← Findings!E5 		1 lot $2,867.50 $2,867.50
1 lot $1,450 $1,450.00
Subtotal
$13,438.00
Tax (10%)
$1,343.80
Total Total → Findings!E8
$14,781.80
Deposit on signing (30%)
$4,434.54

Accept the remediation quote Demo: nothing is sent, stored or charged

Rowan PikeHead of IT, Tessaly Logistics

Paid 30% deposit $4,434.54 via Stripe · signed with a legally binding eSignature · certificate of authenticity attached

A demo with a fictional firm and clients: nothing is sent, stored or charged. With QuoteCloud's MCP service (Essentials and up), your AI assistant can be set up to find the client, create documents from your templates as drafts and write a section for review; it reads only what you allow and sends nothing. The counts reach the quote's Spreadsheet block through a Zapier step or your analyst. QuoteCloud doesn't scan, test or monitor anything: the findings and their severity come from your tools and your team.

How AI-drafted reports and quotes work

From the export to the deposit in five steps

What happens between your scanner finishing and the client paying to fix what it found.

  1. Export the results

    Your scanner, test notes or monitoring platform produce the data, as they do today.

  2. The assistant drafts

    Through QuoteCloud's MCP service, it creates the report and the quote from your templates, as drafts.

  3. Your analyst reviews

    Accept or rewrite the flagged summary and check the counts in the pricing sheet.

  4. Send both together

    The report and the quote go out from your analyst, with tracking on both.

  5. Signed and paid

    The client ticks the retest, signs, and pays a deposit or in full through Stripe or PayPal.

Four reports, each ending in a decision

The documents a security firm sends every month, built from data held in other systems, with the next step priced inside them.

Northlatch SecurityMonthly vulnerability scan report NL-VS-2611 Sample · fictional business

Executive summary October 2026 · scan run Wed 14 Oct

  • Critical 2 −2 since last
  • High 7 −3 since last
  • Medium 18 −3 since last
  • Low 31 +2 since last
Scope
External and internal · 212 assets · head office, Northgate and Lakeview depots
Source
From your scanner's export, reviewed by Dev Kapoor
Fixed since last report
14 · 9 new
Drafted by AI · review Summary accepted

Open critical and high findings fell from 14 to 9 since September. The two critical findings both sit at the edge of the network: the remote access gateway is missing a security update, and a database server can be reached from the guest Wi-Fi. We recommend fixing both this week, then the seven high findings, most of which are old software on depot PCs and printers.

Findings, highest first Severity is Northlatch's rating after review of the scanner's output

RefFindingSeverityStatus
F-01 Remote access gateway missing a security updatevpn-gw-01 · external Critical Open
F-02 Database server reachable from the guest Wi-Fidb-02 · internal Critical Open
F-03 Old TLS versions still enabled on the customer portalportal.tessaly.example.com High Open
F-04 Default password on a warehouse label printerprn-lk-03 · Lakeview High Open

4 more findings in the full report

A scan report the client can read in five minutes

Severity by severity, against last month, with the summary your analyst accepted and the findings ranked. The remediation quote that prices them goes out beside it.

  • Drafted from your scanner's export
  • Severity is your rating, not the scanner's
  • Comments on any finding
Vulnerability scan reports
Northlatch SecurityPenetration test report NL-PT-2588 Sample · fictional business

Executive summary Tested 16–27 Nov · retested 3 Dec

  • Critical 1
  • High 3
  • Medium 5
  • Low 4
Scope
app.brightfern.example.com · api.brightfern.example.com · 203.0.113.16/28
Source
From Felix Aranda's test notes and evidence
Fixed since last report
9
Drafted by AI · review Summary accepted

One critical issue let an attacker take over any account through the password-reset flow; it was fixed within two days and the fix held on retest. Of the three high findings, two are fixed and verified, and one (no lockout on the login form) has a fix scheduled for January.

Findings and retest status Rated by the tester; evidence in the appendix

RefFindingSeverityStatus
PT-01 Account takeover through the password-reset flowapp.brightfern.example.com Critical Fixed · verified
PT-02 Another customer's invoices readable by changing an IDapi · /v2/invoices High Fixed · verified
PT-03 Admin panel reachable from the internetadmin.brightfern.example.com High Fixed · verified
PT-04 No lockout or rate limit on the login formapp · /login High Fix scheduled

2 more findings in the full report

Report received and accepted

Juno Adeyemi · CTO, Brightfern Software

Signed online · 4 Dec, 9:05 am

This report

Version
1.1 · with retest
Open findings
1 high (fix scheduled)
Accepted risks
1 medium

Certificate of authenticity and audit trail attached

Findings, retest status and the client's sign-off

The executive summary, every finding with its retest status, and the CTO's signature accepting the report, with a certificate of authenticity.

  • From your tester's notes
  • Fixed, scheduled or accepted risk
  • Signed acceptance of the report
Penetration test reports
Northlatch SecurityCompliance gap audit NL-GA-0417 Sample · fictional business

Control areas: where you are and where you're going Against your chosen framework

  • 2Met
  • 3Partial
  • 3Gap
  1. C-01 Governance & policiesPolicies exist but are three years old. Partial
  2. C-02 Asset inventoryNo single list of devices across the clinics. Gap
  3. C-03 Access & identityMFA on email; not yet on the practice system. Partial
  4. C-04 Patching & vulnerabilitiesMonthly scans and patching in place. Met

Where you are TargetScale: Initial → Developing → Defined → Managed → Optimised

Your roadmap

ItemQtyRateAmount
Phase 1 · next 90 days$8,900
Incident response plan & contact treeCloses C-06 · a tabletop exercise with the practice managers
1 lot $3,800 $3,800.00
Asset inventory across five clinicsCloses C-02 · devices, owners and what they hold
1 lot $2,900 $2,900.00
Supplier reviewCloses C-07 · who holds patient data, and on what terms
1 lot $2,200 $2,200.00
Phase 2 · choose what to add Tick to add
 1 lot $1,900 $1,900.00
1 lot $4,200 $4,200.00
1 lot $2,600 $2,600.00
Subtotal
$10,800.00
Tax (10%)
$1,080.00
Total
$11,880.00
Deposit on signing (25%)
$2,970.00

Where they stand, and a roadmap they can approve

Each control area against the framework the client chose, current and target maturity, then the roadmap as a price table: phase one included, phase two ticked item by item.

  • Your assessment, your framework
  • Phase two as options
  • A deposit on signing
Compliance gap audits
Northlatch SecurityMonthly managed security report NL-MSR-2610 Sample · fictional business

October at a glance 1–31 October · from your monitoring platform's monthly export

  • Endpoints monitored64 of 642 new laptops added
  • Alerts reviewed412All triaged by an analyst
  • Escalated to you63 phishing reports
  • Incidents1Contained in 38 minutes
  • Patch compliance94%Target 95%
  • Sign-in protection98%1 shared mailbox left
Drafted by AI · review Summary accepted

A quiet month. The one incident was a partner's laptop that opened a malicious attachment on the 17th; it was isolated within 38 minutes and nothing left the device. Patching is one point under target because of two laptops that were away on leave.

Recommended for November

ItemQtyRateAmount
Tick what you'd like us to do Tick to add
 1 lot $900 $900.00
Monthly $340 $340.00/mo
1 lot $1,200 $1,200.00
Subtotal
$900.00
Tax (10%)
$90.00
Total
$990.00
Added to your monthly agreement
$340.00/mo
Paid on signing (once-off items) (100%)
$990.00

The month in figures, and next month's recommendations

Figures from your monitoring platform's monthly export, the summary your analyst accepted, and recommendations the managing partner ticks and pays for in the same document.

  • Drafted from your platform's export
  • Recommendations as options
  • Once-off items paid on signing
Monthly managed security reports

Send your next report and quote from QuoteCloud

Free for 14 days, no credit card required. Send us a past report and your remediation pricing, and we'll convert one template for you during the trial.

Start free 14-day trial Book a demo

Findings × hours × rate: the sheet that prices the fix

Your remediation calculator becomes a Spreadsheet block in the quote template: findings by severity, your hours for each, your engineer rate. Connect any cell to a price line's description and unit price, and bring the price table total back into a cell.

In Northlatch's sheet, row 2 writes "Fix 2 critical findings · est. 12 h" and its $2,220 into the first line. When the client ticks the retest, the new total lands in Findings!E8 and the cost per finding fixed recalculates. Quantities, options and choices stay on the price table as usual.

  • Cell → a line's description and unit price
  • Price table total → a cell
  • Formulas, tabs and .xlsx import, like any spreadsheet
  • Zapier can write the export's counts into the cells

Spreadsheet block, price tables and Zapier: Essentials and up

Remediation quotes priced from findings
Northlatch SecurityRemediation quote NL-Q-2614 Sample · fictional business

Findings tab

Remediation pricing.xlsxSpreadsheet block
E2 =D2*$C$7

Findings

RowABCDEF
1 Severity Findings Hours each Hours Line price Line description
2 Critical 2 6 12 $2,220 Fix 2 critical findings · est. 12 h
3 High 7 3 21 $3,885 Fix 7 high-severity findings · est. 21 h
4 Medium 18 1.5 27 $4,995 Fix 18 medium-severity findings · est. 27 h
5 Low 31 0.5 15.5 $2,867.50 Clean up 31 low-severity findings · est. 15.5 h
6 Coordination 8% $888 Change control & coordination
7 Engineer rate /h $185 Northlatch's rate card
8 Quote total Price table$14,781.80 Brought back from the price table
9 Per finding fixed $547.47 Estimate
  • Counts typed in or written by Zapier
  • Your assumption
  • Estimate
  • Connected to the price table

Remediation, priced from the findings Editor view · link chips show where each line comes from

ItemQtyRateAmount
Fixes$11,988
Fix 2 critical findings · est. 12 hF-01, F-02 · this week
Description ← Findings!F2 Unit price ← Findings!E2 		1 lot $2,220 $2,220.00
Fix 7 high-severity findings · est. 21 hF-03 to F-05 and four more
Description ← Findings!F3 Unit price ← Findings!E3 		1 lot $3,885 $3,885.00
Fix 18 medium-severity findings · est. 27 hGrouped by system, within 30 days
Description ← Findings!F4 Unit price ← Findings!E4 		1 lot $4,995 $4,995.00
Change control & coordinationChange requests, out-of-hours windows, sign-off
Unit price ← Findings!E6 		1 lot $888 $888.00
Options Tick to add
Clean up 31 low-severity findings · est. 15.5 hOr accept them as risks in the next report
Description ← Findings!F5 Unit price ← Findings!E5 		1 lot $2,867.50 $2,867.50
Retest of fixed findingsWe confirm every fix worked, with a short retest report
1 lot $1,450 $1,450.00
Subtotal
$13,438.00
Tax (10%)
$1,343.80
Total Total → Findings!E8
$14,781.80
Deposit on signing (30%)
$4,434.54

Managed security priced per endpoint, per tier

Endpoints and users × the tier the client chooses → the monthly price, with servers, cloud tenants, onboarding and options on the same page. Quenby & Hart change the tier or the endpoint count and the monthly, once-off and contract totals follow.

Both partners sign, onboarding is paid on signing, and the agreement's expiry date puts it on your Expiring Soon list long before the term ends. Monthly charges are invoiced by you.

  • Service tiers as one choice
  • Endpoint and user counts the client can adjust
  • 12, 24 or 36-month terms
  • Expiry dates and the Expiring Soon filter

Price tables, payments and expiry dates: Essentials and up

Managed security service proposals
Northlatch SecurityManaged security proposal NL-M-3120 Sample · fictional business

Choose your service tier Per endpoint, per month
Monitoring24/724/724/7
Alerts triaged by an analystBusiness hours24/724/7
Containment on your behalfNot includedIncludedIncluded
Monthly reportIncludedIncludedIncluded
Quarterly review with the partnersNot includedIncludedIncluded
Incident response hoursNot included2 a quarter8 a quarter

Your services, per endpoint and per user

ItemQtyMonthlyOnce-off
Managed detection & response$704—
Detect & respondMDR-DR · Per endpoint · change the tier above
64 $704 —
Identity, servers & cloud$684—
Email & sign-in monitoringID-MON · Per user
58 $232 —
Server monitoringSRV-MON · Per server
4 $112 —
Cloud tenant monitoringCLD-MON · Per tenant
2 $340 —
Onboarding, once-off—$4,650
Onboarding & agent rolloutONB-MDR · Every endpoint, tuned to your firm
1 — $3,200
Baseline vulnerability scanVS-BASE · So month one has a starting point
1 — $1,450
Options Tick to add
 58 $174 —
1 $650 —
Monthly recurring
$1,562/mo
Once-off
$4,650
Total contract value over 24 months
$42,138
Onboarding paid on signing (50% of once-off)
$2,325

All prices excluding tax. Monthly charges apply for the term and are invoiced by Northlatch Security.

Trusted by service businesses since 2013

  • eIDAS compliant eSignatures
  • 256-bit encryption
  • Hosted on AWS
  • GDPR compliant

AI drafts. Your people decide.

How QuoteCloud's own articles say an MCP implementation should be set up, and how the documents behave once it is.

  • Drafts, not sends

    Set the assistant up to create reports and quotes as drafts. Your analyst reviews and sends them; nothing goes to a client without a person.

  • Only what it's allowed

    Give it the minimum it needs: which clients, which templates, which actions. A reporting assistant may need read access and nothing more.

  • Flagged until accepted

    A section the assistant writes is marked for review, and stays marked until someone accepts or rewrites it.

  • Your rules still apply

    Drafts are ordinary QuoteCloud documents: approval rules on discount or total value apply before they can be sent (Business).

What changes for the team

The same work your analysts and consultants do today, with the copying, formatting and chasing taken out.

The jobTodayWith QuoteCloud
Writing the monthly scan report Export to a spreadsheet, paste into last month's Word file, fix the formatting, write the summary from scratch. The assistant drafts it from your template; the analyst checks the counts and accepts or rewrites the summary.
Pricing the remediation Count findings by hand, multiply in a separate sheet, type the numbers into a quote. The counts land in the quote's own sheet, which sets each line's description and price.
Getting the go-ahead A PDF by email, a purchase order weeks later, an invoice for the deposit after that. The client ticks the retest, signs and pays the deposit in the same document.
Authorisation to test A scanned form with one signature missing on the morning testing starts. Rules of engagement signed by every party, each signature recorded with a certificate of authenticity.
Renewals Someone notices an agreement has expired when the client asks why monitoring stopped. Expiry dates put every agreement on the Expiring Soon list in time to send the renewal.

Connect your assistant, your CRM and your payments

MCP for your AI assistant, the API and Zapier for your tools' exports, and the CRM, accounting and payment apps you already use.

How security firms connect QuoteCloud All integrations

Start from a real QuoteCloud template

Cybersecurity, service-level and consulting templates from the QuoteCloud library, ready for your report and quote layouts.

All cybersecurity templates Templates for cybersecurity services

Everything QuoteCloud does for a security firm

Report, price, authorise and sign: one page for each.

Questions security firms ask

Does QuoteCloud scan or test my clients' systems?

No. QuoteCloud makes the documents: reports, quotes, proposals and agreements. The data comes from your own scanner, test notes or monitoring platform, and the findings and their severity are your team's. QuoteCloud turns that work into a branded report, prices the fix and collects the signature and payment.

How does an AI assistant draft a report in QuoteCloud?

QuoteCloud's MCP service lets an AI assistant work with QuoteCloud. It can be set up to find the client, create the report and the quote from your templates as drafts and write a summary section, flagged for review. Your analyst checks, accepts or rewrites, and sends. MCP is on Essentials and up.

Can the assistant send a report to a client by itself?

Set it up so it can't. QuoteCloud's guidance for MCP is to give an assistant only the access a workflow needs, for example creating drafts but not sending them. Drafts are ordinary documents, so approval rules on discount or total value also apply before sending (approvals are on Business).

How is a remediation quote priced from the findings?

Put your pricing calculator in a Spreadsheet block in the quote template: findings by severity, hours for each, your rate. Any cell connects to a price line's description and unit price, and the price table total can come back into a cell. Counts are typed in by your analyst or written into the cells by a Zapier step.

Can clients pay a deposit when they sign?

Yes. Set a deposit as a percentage or a fixed amount, or ask for the full amount, and the client pays through Stripe or PayPal when they sign. Payments are on Essentials and up. Any balance or monthly fee is invoiced by you.

Can several people sign an authorisation to test?

Yes. A document can have several signers, such as the client's CTO and CEO and your director, and each signature is recorded with an audit trail and a certificate of authenticity. QuoteCloud records who signed; whether they have authority over the systems is their statement.

Do you certify my clients against a framework?

No. A gap audit in QuoteCloud is your assessment against the framework your client chose, written in your report template. QuoteCloud doesn't certify, audit or verify compliance with any framework or standard.

How is this different from QuoteCloud for IT services?

The IT services pages are for MSPs selling per-user support, licences and projects. These pages are for security specialists whose product is the report itself: scan and test reports, gap audits and monthly security reports, with the remediation priced from the findings.

More questions from security firms

Your next report, and the quote that fixes what it found

Start a free 14-day trial: build your report and remediation templates, connect your pricing sheet, and send both from one place.

Start free 14-day trial Book a demo

See pricingCybersecurity templatesAll industries