Cybersecurity services FAQ
What QuoteCloud does and doesn't do for security firms: reports, MCP, pricing sheets, signatures, payments and integrations.
- 5/5 on G2
- 4.2 on Capterra
- Building QuoteCloud since 2013
This FAQ answers the questions security firms ask about QuoteCloud: what it does with scanner and test data (documents, not scanning), how an AI assistant connects through the MCP service and what it can be set up to do, how a spreadsheet prices remediation, signing and payments, and which plan each feature needs.
Last reviewed by the QuoteCloud team
Penetration test proposal
Penetration test: web app, API & external hosts
Prepared for Brightfern Software · 28 October · Valid 30 days
A two-week test of the customer web app as three kinds of user, the public API and your 16 external hosts, with a report written for the board and a technical appendix for your engineers.
Testing scope
| Item | Qty | Rate | Amount |
|---|---|---|---|
| Testing | $18,975 | ||
External infrastructure test · 2 days16 hosts in 203.0.113.16/28
|
1 lot | $3,300 | $3,300.00 |
Web application test · 5.5 days (3 roles)Customer, account admin and support staff
|
1 lot | $9,075 | $9,075.00 |
API test · 2.5 days (42 endpoints)Public API, authenticated and not
|
1 lot | $4,125 | $4,125.00 |
Report & readout · 1.5 daysBoard summary, technical appendix, a one-hour readout
|
1 lot | $2,475 | $2,475.00 |
| Extra tests Tick to add | |||
Retest within 60 days · 1 dayEvery fixed finding checked, report updated
|
1 lot | $1,650 | $1,650.00 |
Phishing campaignOne campaign to every staff member, results in the report
|
1 lot | $2,400 | $2,400.00 |
- Subtotal
- $20,625.00
- Tax (10%)
- $2,062.50
- Total
- $22,687.50
- Plus, monthly
- $0.00/mo
- Payment on signing (50%)
- $11,343.75
Accept, sign and pay
Juno Adeyemi · CTO, Brightfern Software
Signed online · 30 Oct, 4:20 pm
Payment on signing (50%)
$11,343.75
Paid via StripePay with card or PayPal
Certificate of authenticity and audit trail attached
- Proposal openedJuno Adeyemi
- CommentDoes the API count include the webhooks?
- Signed onlineOne-time passcode checked
- 50% paid on signing$11,343.75 via Stripe
- Opened
- Retest ticked
- Signed
- 50% paid
Reports and your data
Does QuoteCloud run vulnerability scans or penetration tests?
No. QuoteCloud makes and sends the documents: reports, quotes, proposals and agreements. Scanning, testing and monitoring are done by your own tools and team. The findings and their severity ratings are yours, and QuoteCloud presents them, prices the fix and collects the signature and payment.
Can QuoteCloud certify a client against a security framework?
No. A gap audit sent from QuoteCloud is your firm's assessment against the framework your client chose, in your own report template. QuoteCloud doesn't certify, audit or verify compliance with any framework or standard, and it doesn't issue certificates of compliance.
How does scan data get into a QuoteCloud report?
Three ways: your analyst enters it, a Zapier or Make step brings it in where your tool has a connector, or your own systems create the document through the QuoteCloud API. With the MCP service, your AI assistant can also be set up to draft the report from your template for review.
Can clients comment on individual findings?
Yes. Clients can comment in the document and your team can reply, so a question about one finding is answered next to it, and the thread stays with the report.
AI drafts and the MCP service
What is QuoteCloud's MCP service?
It lets an AI assistant work with QuoteCloud. Your assistant can be set up to find a client, create a document from a template, add catalogue lines and write a section, all as drafts for a person to review. MCP is on Essentials and up.
Does the AI write and send reports by itself?
No. A section the assistant writes is flagged until someone accepts or rewrites it, documents are created as drafts, and nothing is sent without a person. Approval rules on discount or total value still apply before sending (approvals are on Business).
Which AI assistants work with QuoteCloud's MCP service?
Ask the QuoteCloud team. Which assistants connect, and how the connection is authorised, depend on your setup, and consultancy and integration setup are available from the QuoteCloud team. Whatever the assistant, it works on drafts for a person to review.
How do we limit what the assistant can see?
Give it the minimum each workflow needs: which clients, which templates and which actions. A reporting assistant may need read access and nothing more, and a drafting assistant can create drafts without being able to send them.
Pricing sheets and quotes
How does a spreadsheet price a remediation quote?
Put your calculator in a Spreadsheet block in the quote template: findings by severity, hours each and your rate. Any cell can set a price line's description and unit price, and the price table total can come back into a cell. Quantities are set on the lines as usual.
Can Zapier fill in the finding counts?
Yes. Zapier can write values into a document's spreadsheet cells, for example the counts by severity from a step that reads your scanner's export. The sheet then sets the line prices, and your analyst checks the counts before the quote is sent.
Can clients choose options such as a retest?
Yes. Put the retest, the low-severity clean-up or a phishing campaign in an optional group. The client ticks what they want and the totals and the deposit update. No automation ticks options for the client.
Can I hide my costs and margins from the client?
Yes. Price tables can carry a cost for each line, and costs and margins are shown to your team only, never to the client. Price tables and the Product Library are on Essentials and up.
Signing and payments
Are QuoteCloud eSignatures legally binding?
QuoteCloud eSignatures are legally binding, on every plan. Each signature is recorded in an audit trail, and the signed document carries a certificate of authenticity. Signers don't need a QuoteCloud account.
Can clients pay when they sign?
Yes. Ask for a deposit as a percentage or a fixed amount, or the full amount, and the client pays through Stripe or PayPal as they sign. Payments are on Essentials and up. Balances and monthly fees are invoiced by your firm.
Does QuoteCloud send payment reminders or bill monthly?
No. QuoteCloud takes the payment on signing. It doesn't send payment reminders, split payments into instalments, or bill monthly fees. Your firm invoices those as it does today.
Can managed security agreements renew automatically?
No. Each agreement has an expiry date, and the Expiring Soon filter shows the ones ending soon so your team can send a renewal. The client signs the renewal as a new or revised document.
Each answer, shown in a real document
Every page of this site walks through a sample document from a fictional security firm.
AI-drafted reports and quotes
What an assistant connected through MCP can be set up to draft, and what your analyst still decides.
AI drafts with MCPVulnerability scan reports
A monthly report from your scanner's export, with a summary your analyst accepts.
Scan reportsRemediation quotes
Findings × hours × rate in a Spreadsheet block that sets the price lines.
Remediation quotesManaged security proposals
Tiers per endpoint on a term, with renewals on the Expiring Soon list.
Managed securityAuthorisation to test
Rules of engagement signed by every party, with a certificate of authenticity.
Authorisation & signingIntegrations and automation
MCP, the API, Zapier and Make, and how each of your tools really connects.
Integrations
Try it on your own report and quote
Free for 14 days, no credit card required. Send us a past report and we'll convert one template for you during the trial.
Plans and getting started
Which QuoteCloud plan does a security firm need?
Most of this site needs Essentials (US$39 per user a month): price tables, the Spreadsheet block, MCP, the API and Zapier, payments, tracking and expiry dates. Business (US$59) adds approvals, content locking, version history, the AI Co-Worker and native CRM and accounting integrations.
Is there a free trial?
Yes. Essentials and Business start with a 14-day free trial, with no credit card needed. One template is converted free during the trial, so you can test QuoteCloud on your own report or quote.
Do clients need a QuoteCloud account?
No. Clients open the document from a link, choose options, sign and pay without an account. Only your own team needs QuoteCloud users.
Is QuoteCloud the same as the IT services pages?
It's the same software. The IT services pages show MSPs selling per-user support and projects. These pages show security firms whose product is the report: scan and test reports, gap audits and monthly security reports, with the remediation priced from the findings.
More for security firms
Every page of QuoteCloud for cybersecurity services.
-
AI-drafted reports & quotes with MCPYour AI assistant, connected through QuoteCloud's MCP service, drafts the report and the priced quote for an analyst to review.Explore
-
Penetration test reportsExecutive summary, findings with evidence and retest status, and the client's sign-off in one document.Explore
-
QuoteCloud implementation for security firmsReport and quote templates, your pricing sheet, the MCP connection and analyst training, step by step.Explore
- Vulnerability scan reportsMonthly and quarterly scan results as a branded report: severity summary, findings, trend and what to fix first.
- Compliance gap auditsControls against your chosen framework, current and target maturity, and the roadmap priced as options.
- Monthly managed security reportsThe month in alerts, incidents and patching from your monitoring platform, with next month's recommendations to tick.
- Remediation quotes priced from findingsFindings by severity × hours × rate in a Spreadsheet block that sets the price lines, plus a retest the client ticks.
- Penetration test & assessment proposalsScope by IPs, apps and APIs, days worked out in your scoping sheet, and extra tests as options.
- Managed security service proposalsEndpoints and users × service tier → the monthly price, on a term, with renewals you can see coming.
- vCISO & advisory retainersAdvisory days a month as packages the client chooses, with the board reporting and roadmap in writing.
- Authorisation to test & signingRules of engagement and written authorisation signed by every party, then a deposit or full payment on signing.
- Integrations & automationMCP, the API, Zapier and Make, plus CRM, accounting, Slack and Teams, connected the way each one really connects.
- Cybersecurity templatesReal QuoteCloud cybersecurity, SLA and consulting templates, ready for your report and quote layouts.
Still have a question? Ask us, or try it
Start a free 14-day trial and send your first report and remediation quote, or book a demo and ask the QuoteCloud team directly.
QuoteCloud for security firmsFree 14 days · no card
Start free trial