Penetration test proposals scoped by your own sheet
Hosts, app roles and API endpoints in, days and prices out: the proposal prices itself from the scope, and extra tests are options to tick.
- 5/5 on G2
- 4.2 on Capterra
- Building QuoteCloud since 2013
QuoteCloud lets testers scope a penetration test in a Spreadsheet block inside the proposal: external hosts, web app roles and API endpoints become days, and connected cells set each line's description and price. Extra tests such as a retest or phishing campaign are options the client ticks, then signs and pays a share on signing.
Last reviewed by the QuoteCloud team
An engineered drawing of a fictional software company's test targets on one plate: 16 external host blocks in a grid, the web app as three role tiers and the API as a block ruled with 42 endpoint ticks, each joined by a green line to the scoping sheet in front. Beside it, the scoping card for Brightfern Software, proposal NL-P-0931: external hosts 16 × 0.125 = 2 days, $3,300; web app roles 3 × 0.5 plus 4 = 5.5 days, $9,075; API endpoints 42 × 0.05 = 2.5 days, $4,125; report and readout 1.5 days, $2,475; 11.5 days at a $1,650 day rate, the retest ticked; total $22,687.50 inc tax, signed by Juno Adeyemi with 50% ($11,343.75) paid on signing.
The scoping sheet is the proposal
Felix counts the targets on the scoping call: 16 external hosts, three user roles, 42 API endpoints. In the proposal's Spreadsheet block each count becomes days, from Northlatch's own days-per-target, and the days times the day rate become each line's price.
Connected cells set the description and unit price of every testing line, and the total comes back into Scoping!E8. Brightfern ticks the retest, signs, and pays half on signing.
- Counts in, days and prices out
- Your days-per-target, labelled as assumptions
- Extra tests as options
- 50% on signing via Stripe
Spreadsheet block, price tables and payments: Essentials and up
The same idea for remediation quotesScoping tab
=D3*$C$7
Scoping
| Row | A | B | C | D | E | F |
|---|---|---|---|---|---|---|
| 1 | Target | Count | Days each | Days | Line price | Line description |
| 2 | External hosts | 16 | 0.125 | 2 | $3,300 | External infrastructure test · 2 days |
| 3 | Web app roles | 3 | 0.5 | 5.5 | $9,075 | Web application test · 5.5 days (3 roles) |
| 4 | API endpoints | 42 | 0.05 | 2.5 | $4,125 | API test · 2.5 days (42 endpoints) |
| 5 | Report & readout | 1.5 | $2,475 | Report & readout · 1.5 days | ||
| 6 | Total days | 11.5 | ||||
| 7 | Day rate | $1,650 | Northlatch's rate card | |||
| 8 | Proposal total | Price table$22,687.50 | Brought back from the price table |
- Counts typed in or written by Zapier
- Your assumption
- Estimate
- Connected to the price table
Testing scope Editor view · link chips show where each line comes from
| Item | Qty | Rate | Amount |
|---|---|---|---|
| Testing | $18,975 | ||
External infrastructure test · 2 days16 hosts in 203.0.113.16/28
Description ← Scoping!F2 Unit price ← Scoping!E2
|
1 lot | $3,300 | $3,300.00 |
Web application test · 5.5 days (3 roles)Customer, account admin and support staff
Description ← Scoping!F3 Unit price ← Scoping!E3
|
1 lot | $9,075 | $9,075.00 |
API test · 2.5 days (42 endpoints)Public API, authenticated and not
Description ← Scoping!F4 Unit price ← Scoping!E4
|
1 lot | $4,125 | $4,125.00 |
Report & readout · 1.5 daysBoard summary, technical appendix, a one-hour readout
Unit price ← Scoping!E5
|
1 lot | $2,475 | $2,475.00 |
| Extra tests Tick to add | |||
| 1 lot | $1,650 | $1,650.00 | |
| 1 lot | $2,400 | $2,400.00 | |
- Subtotal
- $20,625.00
- Tax (10%)
- $2,062.50
- Total Total → Scoping!E8
- $22,687.50
- Plus, monthly
- $0.00/mo
- Payment on signing (50%)
- $11,343.75
Accept, sign and pay
Juno Adeyemi · CTO, Brightfern Software
Signed online · 30 Oct, 4:20 pm
Payment on signing (50%)
$11,343.75
Paid via StripePay with card or PayPal
Certificate of authenticity and audit trail attached
One template for each kind of test
Every test type counts different targets. Give each its own proposal template and scoping sheet.
=D2*$C$4
Scoping
| Row | A | B | C | D | E | F |
|---|---|---|---|---|---|---|
| 1 | Target | Count | Days each | Days | Line price | Line description |
| 2 | External hosts | 24 | 0.125 | 3 | $4,950 | External infrastructure test · 3 days (24 hosts) |
| 3 | Report & readout | 1 | $1,650 | Report & readout · 1 day | ||
| 4 | Day rate | $1,650 | Northlatch's rate card | |||
| 5 | Proposal total | Price table$9,075.00 | Brought back from the price table |
Testing scope Editor view · link chips show where each line comes from
| Item | Qty | Rate | Amount |
|---|---|---|---|
| Testing | $6,600 | ||
External infrastructure test · 3 days (24 hosts)Head office and both depots
Description ← Scoping!F2 Unit price ← Scoping!E2
|
1 lot | $4,950 | $4,950.00 |
Report & readout · 1 dayBoard summary and technical appendix
Unit price ← Scoping!E3
|
1 lot | $1,650 | $1,650.00 |
| Extra tests Tick to add | |||
| 1 lot | $1,650 | $1,650.00 | |
- Subtotal
- $8,250.00
- Tax (10%)
- $825.00
- Total Total → Scoping!E5
- $9,075.00
- Plus, monthly
- $0.00/mo
- Payment on signing (50%)
- $4,537.50
External infrastructure: count the hosts
Tessaly's 24 internet-facing hosts at an eighth of a day each: three days of testing plus a day for the report.
- Hosts × days each
- Report and readout as its own line
- Retest ticked by the client
=D2*$C$4
Scoping
| Row | A | B | C | D | E | F |
|---|---|---|---|---|---|---|
| 1 | Target | Count | Days each | Days | Line price | Line description |
| 2 | Web app roles | 2 | 0.5 | 5 | $8,250 | Web application test · 5 days (2 roles) |
| 3 | Report & readout | 1.5 | $2,475 | Report & readout · 1.5 days | ||
| 4 | Day rate | $1,650 | Northlatch's rate card | |||
| 5 | Proposal total | Price table$13,612.50 | Brought back from the price table |
Testing scope Editor view · link chips show where each line comes from
| Item | Qty | Rate | Amount |
|---|---|---|---|
| Testing | $10,725 | ||
Web application test · 5 days (2 roles)Client and staff logins, on staging
Description ← Scoping!F2 Unit price ← Scoping!E2
|
1 lot | $8,250 | $8,250.00 |
Report & readout · 1.5 daysBoard summary and technical appendix
Unit price ← Scoping!E3
|
1 lot | $2,475 | $2,475.00 |
| Extra tests Tick to add | |||
| 1 lot | $1,650 | $1,650.00 | |
- Subtotal
- $12,375.00
- Tax (10%)
- $1,237.50
- Total Total → Scoping!E5
- $13,612.50
- Plus, monthly
- $0.00/mo
- Payment on signing (50%)
- $6,806.25
Web applications: count the roles
Quenby & Hart's client portal: four base days plus half a day for each kind of login, client and staff.
- Base days + roles × days
- Staging or production stated
- Retest within 60 days
=D2*$C$4
Scoping
| Row | A | B | C | D | E | F |
|---|---|---|---|---|---|---|
| 1 | Target | Count | Days each | Days | Line price | Line description |
| 2 | API endpoints | 26 | 0.05 | 1.5 | $2,475 | API test · 1.5 days (26 endpoints) |
| 3 | Report & readout | 1 | $1,650 | Report & readout · 1 day | ||
| 4 | Day rate | $1,650 | Northlatch's rate card | |||
| 5 | Proposal total | Price table$4,537.50 | Brought back from the price table |
Testing scope Editor view · link chips show where each line comes from
| Item | Qty | Rate | Amount |
|---|---|---|---|
| Testing | $4,125 | ||
API test · 1.5 days (26 endpoints)Patient booking API, authenticated and not
Description ← Scoping!F2 Unit price ← Scoping!E2
|
1 lot | $2,475 | $2,475.00 |
Report & readout · 1 dayFindings and fixes for your developers
Unit price ← Scoping!E3
|
1 lot | $1,650 | $1,650.00 |
| Extra tests Tick to add | |||
| 1 lot | $1,650 | $1,650.00 | |
- Subtotal
- $4,125.00
- Tax (10%)
- $412.50
- Total Total → Scoping!E5
- $4,537.50
- Plus, monthly
- $0.00/mo
- Payment on signing (50%)
- $2,268.75
APIs: count the endpoints
Oakhurst's booking API: 26 endpoints at a twentieth of a day each, rounded up to the half day with ROUNDUP.
- ROUNDUP to half days
- Authenticated and not
- Retest offered, not ticked
=D2*$C$4
Scoping
| Row | A | B | C | D | E | F |
|---|---|---|---|---|---|---|
| 1 | Target | Count | Days each | Days | Line price | Line description |
| 2 | Phone calls | 10 | 0.1 | 1 | $1,650 | Phone pretext calls · 1 day (10 calls) |
| 3 | Readout | 0.5 | $825 | Awareness readout · 0.5 day | ||
| 4 | Day rate | $1,650 | Northlatch's rate card | |||
| 5 | Proposal total | Price table$5,362.50 | Brought back from the price table |
Testing scope Editor view · link chips show where each line comes from
| Item | Qty | Rate | Amount |
|---|---|---|---|
| Testing | $4,875 | ||
Phishing campaignOne campaign to all 58 staff · catalogue item
|
1 lot | $2,400 | $2,400.00 |
Phone pretext calls · 1 day (10 calls)Reception and IT help desk, agreed scripts
Description ← Scoping!F2 Unit price ← Scoping!E2
|
1 lot | $1,650 | $1,650.00 |
Awareness readout · 0.5 dayA session for partners and staff
Unit price ← Scoping!E3
|
1 lot | $825 | $825.00 |
| Extra tests Tick to add | |||
| 1 lot | $2,400 | $2,400.00 | |
- Subtotal
- $4,875.00
- Tax (10%)
- $487.50
- Total Total → Scoping!E5
- $5,362.50
- Plus, monthly
- $0.00/mo
- Payment on signing (50%)
- $2,681.25
Social engineering: count the calls
A phishing campaign from the catalogue, ten phone pretext calls, an awareness readout and a second campaign as an option.
- Catalogue items beside sheet lines
- Agreed scripts in the proposal
- A second campaign to tick
Scoping questions, answered in the proposal
The proposal opens with a Forms block: roles to test, API size, the external range, staging or production, the testing window. Juno answers it before signing, and asks about webhooks in a comment.
The answers come back with the document. Before testing starts, the authorisation to test goes out for every party's signature.
- A form inside the proposal
- Comments on any line
- Opens and reading time tracked
Forms block: Essentials and up
Forms in documentsScoping questions
A Forms block in the proposal · answered before the price is final
- Web app roles to test
- Customer, account admin, support staff
- API endpoints (about)
- 42, including webhooks
- External range
- 203.0.113.16/28
- Test against
- Staging for the app, production for hosts
- Testing window
- 16–27 Nov, business hours
- Technical contact
- juno.adeyemi@example.com
Activity
- Proposal openedJuno Adeyemi
- CommentDoes the API count include the webhooks?
- Signed onlineOne-time passcode checked
- 50% paid on signing$11,343.75 via Stripe
End your next scoping call with a priced proposal
Free for 14 days, no credit card. Import your scoping sheet into the Cybersecurity Proposal template and send the first one today.
Brightfern Software · NL-P-0931
Proposed on Wednesday, signed on Friday
The proposal priced itself from the scoping sheet, the CTO ticked the retest and paid half on signing.
The report it led toFrom the scoping call to a signed proposal
The order Northlatch follows for every test.
Pick the template
External, web app, API or social engineering, each with its own sheet.
Type the counts
Hosts, roles, endpoints or calls; your days-per-target do the rest.
Check the lines
Each line's description and price come from the sheet; add options.
Send with questions
The Forms block collects what you still need to know.
Signed and paid
The client ticks extras, signs and pays a share on signing.
Test proposal questions
How does a scoping sheet price a penetration test?
Put your scoping calculator in a Spreadsheet block in the proposal: counts of hosts, roles or endpoints, your days for each, your day rate. Connect cells to each line's description and unit price, and the proposal prices itself. The days per target are your own estimates.
Can the client add a retest or a phishing campaign?
Yes. Extra tests are optional lines the client ticks before signing. The total and the payment on signing update, and the new total can come back into a cell of your sheet.
Can I collect scoping answers in the proposal?
Yes, with a Forms block (Essentials and up): a form inside the document for roles, API size, ranges, environment and testing window. The answers come back with the document.
Can clients pay part of the fee when they sign?
Yes. Set a payment on signing as a percentage or fixed amount, or the full fee, paid through Stripe or PayPal. Any balance is invoiced by you; QuoteCloud doesn't run payment plans or reminders.
Is there a cybersecurity proposal template?
Yes. QuoteCloud's template library has a Cybersecurity Proposal template and a cybersecurity category. Start from one and add your scoping sheet, your methodology and your extra tests.
Do I still need a separate authorisation to test?
Most firms send rules of engagement and a written authorisation as their own document, signed by every party before testing starts. QuoteCloud records each signature; whether a signer has authority over the systems is their statement.
More for security firms
Authorising the test, reporting it and pricing the fixes.
-
Authorisation to test & signingRules of engagement and written authorisation signed by every party, then a deposit or full payment on signing.Explore
-
Penetration test reportsExecutive summary, findings with evidence and retest status, and the client's sign-off in one document.Explore
-
Cybersecurity templatesReal QuoteCloud cybersecurity, SLA and consulting templates, ready for your report and quote layouts.Explore
- AI-drafted reports & quotes with MCPYour AI assistant, connected through QuoteCloud's MCP service, drafts the report and the priced quote for an analyst to review.
- Vulnerability scan reportsMonthly and quarterly scan results as a branded report: severity summary, findings, trend and what to fix first.
- Compliance gap auditsControls against your chosen framework, current and target maturity, and the roadmap priced as options.
- Monthly managed security reportsThe month in alerts, incidents and patching from your monitoring platform, with next month's recommendations to tick.
- Remediation quotes priced from findingsFindings by severity × hours × rate in a Spreadsheet block that sets the price lines, plus a retest the client ticks.
- Managed security service proposalsEndpoints and users × service tier → the monthly price, on a term, with renewals you can see coming.
- vCISO & advisory retainersAdvisory days a month as packages the client chooses, with the board reporting and roadmap in writing.
- Integrations & automationMCP, the API, Zapier and Make, plus CRM, accounting, Slack and Teams, connected the way each one really connects.
- QuoteCloud implementation for security firmsReport and quote templates, your pricing sheet, the MCP connection and analyst training, step by step.
- FAQAnswers to the questions MSSPs, pen-testers, security consultancies and vCISO firms ask most.
Proposals that price themselves from the scope
Start a free 14-day trial: put your scoping sheet into your proposal template and send your next test proposal from QuoteCloud.