AI-drafted security reports and quotes, reviewed by your analysts
Your AI assistant, connected through QuoteCloud's MCP service, drafts the report and the priced quote from your tools' exports. Your analysts decide what goes out.
- 5/5 on G2
- 4.2 on Capterra
- Building QuoteCloud since 2013
QuoteCloud's MCP service lets an AI assistant work with QuoteCloud. For a security firm it can be set up to find the client, create the report and the remediation quote from your templates as drafts, and write a summary section flagged for review. An analyst checks the counts, accepts the summary and sends. MCP is on Essentials and up.
Last reviewed by the QuoteCloud team
An engineered drawing on one plate: three systems on the left, a scanner export, a monitoring platform's export and a pile of test notes, send a green route into a dark block, the AI assistant connected through QuoteCloud's MCP service. The route forks to two draft sheets, the scan report and the remediation quote, then stops at a gate marked analyst review. Only after the gate does it run on to a signed sheet with a tick. Below, four steps: exports from your tools, drafted by your assistant, reviewed by your analyst, signed by the client; and a session card for the fictional firm Northlatch Security: report NL-VS-2611 and quote NL-Q-2614 ($14,781.80) created as drafts, Dev Kapoor accepted the summary, checked the counts and sent both, Rowan Pike signed and paid the 30% deposit of $4,434.54.
One session: what it read, what it drafted, who decided
Dev, an analyst at Northlatch Security, asks the firm's AI assistant for Tessaly's October report and quote. Connected through QuoteCloud's MCP service, the assistant can be set up to find the client, create both documents from Northlatch's templates as drafts and write the summary, flagged for review.
A Zapier step writes the export's counts into the quote's pricing sheet, which sets the line prices. Then the work comes back to people: Dev reviews and sends, and the client signs and pays.
- Drafts only: a person sends
- Summaries flagged until someone accepts them
- Counts in the sheet, checked by an analyst
- Client signature and deposit on signing
MCP, Spreadsheet block and Zapier: Essentials and up
See the scan report it draftedDev Kapoor asks Draft Tessaly's October scan report and the remediation quote from this week's export.
-
Your AI assistant · MCP
Found Tessaly Logistics in your client list.
Read: client list
-
Your AI assistant · MCP
Created the scan report from the monthly report template, as a draft, and filled in the figures.
Read: the export for this client NL-VS-2611 · draft
-
Your AI assistant · MCP
Wrote the executive summary, marked 'Drafted by AI · review'.
-
Your AI assistant · MCP
Created the remediation quote from the quote template, as a draft, and added the retest from your catalogue.
NL-Q-2614 · draft
-
Zapier step
Wrote the counts 2 · 7 · 18 · 31 into Findings!B2:B5; the connected lines repriced.
-
Dev Kapoor · analyst
Accepted the summary, checked each count against the export, sent the report and the quote.
Reviewed and sent by a person
-
Rowan Pike and Clare Duvall · Tessaly
Ticked the retest, both signed, paid the 30% deposit of $4,434.54.
Signed by the client
An example with fictional data. Which actions an assistant may take is decided in your implementation; nothing here goes to a client without a person.
Decide what it may do, and what stays with people
QuoteCloud's guidance for MCP is to give an assistant the minimum access a workflow needs. For a reporting workflow at a security firm, that could look like this.
Example boundaries · design decisions for your implementation, not a QuoteCloud settings screen
-
The assistant may: Read your client listTo find the client the export belongs to, and only the clients this workflow covers.
Kept for people: Changing client recordsEdits stay with your account managers.
-
The assistant may: Create drafts from named templatesThe monthly scan report and the remediation quote, nothing else.
Kept for people: Sending to a clientYour analyst reviews and sends. Set the assistant up without that action.
-
The assistant may: Write a section, flagged for reviewThe executive summary, from the figures in the draft.
Kept for people: Accepting what it wroteA person accepts or rewrites the summary before it goes anywhere.
-
The assistant may: Add lines from your catalogueThe retest at its catalogue price, for example.
Kept for people: Discounts and large totalsApproval rules on discount or total value decide who signs off (Business).
-
The assistant may: Read the export it's givenOne client's file, not your whole scanner.
Kept for people: Severity and false positivesRatings are your analysts' judgement, not the assistant's.
Read QuoteCloud's article on when and why to implement an MCP AI service: what an assistant can read, which customers, create but not send, suggest but not approve discounts.
Over your limit? It waits for a director
The assistant's drafts are ordinary QuoteCloud documents, so a QuoteCloud implementation applies the same approval rules to them as to anything your team writes.
Oakhurst's quote came out at $19,397.40 inc tax, over Northlatch's $15,000 rule, so it sits In Review until Mara Ellwood approves it. Only then can Priyanka send it.
- Rules on discount % or total value
- One or more approvers
- The log shows who did what
Approval workflow: Business plan
How approval workflows workDocument workflow
In ReviewTriggered when Total value greater than $15,000
- Mara EllwoodDirector, Northlatch SecurityWaiting
The quote can't be sent until it's approved.
- Draft created from your template · your AI assistant
- Counts checked · Priyanka Dass
- Sent for approval · total $19,397.40 inc tax
Approval workflow · Business plan
Remediation, priced from the findings
| Item | Qty | Rate | Amount |
|---|---|---|---|
| Fixes | $16,184 | ||
Fix 3 critical findings · est. 18 hThis week
|
1 lot | $3,330 | $3,330.00 |
Fix 9 high-severity findings · est. 27 hWithin 14 days
|
1 lot | $4,995 | $4,995.00 |
Fix 24 medium-severity findings · est. 36 hGrouped by clinic, within 30 days
|
1 lot | $6,660 | $6,660.00 |
Change control & coordinationFive clinics' change windows
|
1 lot | $1,199 | $1,199.00 |
| Options Tick to add | |||
Clean up 40 low-severity findings · est. 20 hOr accept them as risks
|
1 lot | $3,700 | $3,700.00 |
Retest of fixed findingsA short retest report
|
1 lot | $1,450 | $1,450.00 |
- Subtotal
- $17,634.00
- Tax (10%)
- $1,763.40
- Total
- $19,397.40
- Plus, monthly
- $0.00/mo
- Deposit on signing (30%)
- $5,819.22
Who does what, once it's set up
The assistant takes the copying and the first draft. The judgement, the sending and the signing stay where they are.
Build the templates first, then connect the assistant
Start a free 14-day trial: set up your report and quote templates and your pricing sheet. We'll convert one template for you during the trial.
When an assistant isn't worth connecting
QuoteCloud's own advice is to start from a workflow, not an AI strategy. An MCP implementation pays off where the same document is produced again and again from data that already sits in another system: monthly scan reports for thirty clients, a quote priced from every report.
It's a weaker case when the work looks like this:
- Low volume: a handful of bespoke engagements a year, each report written from scratch.
- General writing help only: the AI Co-Worker in the editor may be enough (Business).
- Messy data: if exports are inconsistent or findings aren't rated the same way, connecting an assistant won't fix that.
- No templates yet: build the report and quote templates first; the assistant fills them, it doesn't design them.
Setting it up, step by step
The order we'd suggest for a security firm's first AI-drafted workflow.
Pick one workflow
Usually the monthly scan report and its remediation quote: high volume, structured data.
Build the templates
A report template and a quote template with your pricing sheet connected to its lines.
Connect the assistant
Through QuoteCloud's MCP service (Essentials and up), with the help of our team if you want it.
Set the boundaries
Which clients, which templates, drafts only, and no sending. Add approval rules for large totals (Business).
Add the counts
A Zapier step writes the export's counts into the sheet, or your analyst types them in.
Questions about AI-drafted reports
What is QuoteCloud's MCP service?
MCP (Model Context Protocol) is a standard way for AI applications to connect to tools and data. QuoteCloud's MCP service lets an AI assistant work with QuoteCloud: it can be set up to find a client, create a document from a template as a draft, add catalogue lines or write a section for review. It's on Essentials and up.
Does the AI write and send my reports automatically?
No. Set up the way QuoteCloud recommends, the assistant creates drafts and marks what it wrote for review. Your analyst checks the figures, accepts or rewrites the summary and sends. Nothing goes to a client without a person.
Which AI assistants can connect?
Assistants and applications that support MCP. We don't name specific products here; talk to our team about the assistant you use and how the connection is set up for your account.
Can the assistant change the prices in a quote?
The prices come from your pricing sheet and catalogue. In this setup a Zapier step writes the finding counts into the sheet's cells and the connected lines follow; your analyst checks them. Discounts and large totals can need approval under your approval rules (Business).
Do approval rules apply to documents the assistant creates?
They're ordinary QuoteCloud documents, so an implementation applies the same approval rules on discount or total value before they can be sent. Approval workflow is on the Business plan.
What data does the assistant see?
Only what you allow. QuoteCloud's guidance is minimum necessary access: for example the client list, two templates and one client's export, with no permission to send or approve. Decide the boundaries in your implementation.
More for security firms
The documents the assistant drafts, and how they're priced and signed.
-
Vulnerability scan reportsMonthly and quarterly scan results as a branded report: severity summary, findings, trend and what to fix first.Explore
-
Remediation quotes priced from findingsFindings by severity × hours × rate in a Spreadsheet block that sets the price lines, plus a retest the client ticks.Explore
-
Integrations & automationMCP, the API, Zapier and Make, plus CRM, accounting, Slack and Teams, connected the way each one really connects.Explore
- Penetration test reportsExecutive summary, findings with evidence and retest status, and the client's sign-off in one document.
- Compliance gap auditsControls against your chosen framework, current and target maturity, and the roadmap priced as options.
- Monthly managed security reportsThe month in alerts, incidents and patching from your monitoring platform, with next month's recommendations to tick.
- Penetration test & assessment proposalsScope by IPs, apps and APIs, days worked out in your scoping sheet, and extra tests as options.
- Managed security service proposalsEndpoints and users × service tier → the monthly price, on a term, with renewals you can see coming.
- vCISO & advisory retainersAdvisory days a month as packages the client chooses, with the board reporting and roadmap in writing.
- Authorisation to test & signingRules of engagement and written authorisation signed by every party, then a deposit or full payment on signing.
- Cybersecurity templatesReal QuoteCloud cybersecurity, SLA and consulting templates, ready for your report and quote layouts.
- QuoteCloud implementation for security firmsReport and quote templates, your pricing sheet, the MCP connection and analyst training, step by step.
- FAQAnswers to the questions MSSPs, pen-testers, security consultancies and vCISO firms ask most.
Let the assistant draft. Let your analysts decide.
Start a free 14-day trial: build your report and quote templates, then connect your AI assistant through QuoteCloud's MCP service.