A financial services company asks you to quote a penetration test for their new web application.
You write a proposal that says, "We will test your web app for vulnerabilities and provide a report." You quote them $5,000.
A week into the engagement, your automated scanner accidentally brings down their production server, knocking their customer portal offline for four hours. The client is furious, demands a refund, and threatens legal action. Furthermore, when you finally deliver the report, the client is angry that you didn't test their internal employee phishing susceptibility, claiming they "thought that was included in a security audit."
You failed because you didn't define the Rules of Engagement (RoE).
Cybersecurity is not software development. You are explicitly being hired to break things. If your proposal does not strictly define what you are breaking, how you are breaking it, and who is responsible when it actually breaks, you are carrying a massive, unpriced risk.
Here is the exact proposal template you must use to quote cybersecurity audits, vulnerability assessments, and penetration testing profitably and safely.
1. The Cover Letter (The Threat Reality)
Do not sell a checklist of compliance standards in the cover letter. Sell the mitigation of financial and reputational ruin.
Hi [Client Name],
Following our discovery call, it is clear that the upcoming launch of your [Application/Platform] introduces new risk vectors into your organization. A breach in this environment would not only compromise [Specific Data Type, e.g., Patient Records/Financial Data], but would also result in severe regulatory penalties and reputational damage.
This proposal outlines a comprehensive Penetration Test designed to identify and exploit vulnerabilities before malicious actors do. We do not just run automated scanners; our team utilizes manual, adversarial tactics to mimic advanced persistent threats, providing you with a realistic assessment of your current security posture.
Please review the Rules of Engagement and Scope limitations below. Once approved, we will lock in your testing window.
Best, [Your Name]
2. The Scope of Work (The "In-Bounds" Targets)
In a cybersecurity quote, what you are NOT testing is more important than what you ARE testing. Define the exact IPs and URLs.
In-Scope Targets: The following assets are explicitly authorized for testing:
- External Web Application:
https://app.clientdomain.com - External APIs:
https://api.clientdomain.com/v1/* - Associated IP Range:
[Insert IP Range]
Out-of-Scope Targets (DO NOT TOUCH): The following assets are strictly prohibited from testing. Any impact on these systems is outside the scope of this engagement:
- The primary marketing website (
https://clientdomain.com). - Internal employee networks or physical social engineering.
- Third-party payment gateways (e.g., Stripe/PayPal environments).
3. The Rules of Engagement (The Liability Shield)
This is the most critical section. It dictates how aggressive your team is allowed to be and protects you if the client's fragile code breaks under pressure.
Rules of Engagement (RoE):
- Testing Window: All active exploitation will be conducted between the hours of 12:00 AM and 4:00 AM EST to minimize potential disruption to peak business hours.
- Denial of Service (DoS): We will explicitly NOT conduct any intentional Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks.
- Exploitation Depth: Upon discovering a vulnerability, our team will exploit it only to the depth necessary to prove the risk (e.g., executing a benign
whoamicommand). We will not extract, modify, or delete any production data. - System Stability Disclaimer: While our team takes extreme care to avoid disrupting services, penetration testing is inherently adversarial. [Your Company] is not liable for unintended system degradation or downtime caused by the testing of fragile or legacy architecture within the authorized scope.
4. The Deliverables (The Remediation Roadmap)
Clients don't want a 200-page PDF of raw scanner output. They want a prioritized action plan.
Post-Engagement Deliverables: Within 5 business days of the conclusion of the testing window, we will deliver:
- Executive Summary: A high-level, non-technical overview of your security posture and overall risk rating, designed for the C-Suite and Board of Directors.
- Technical Findings Report: Detailed technical breakdowns of every identified vulnerability, including CVSS scoring, replication steps, and proof-of-concept evidence.
- Remediation Roadmap: Prioritized, step-by-step patching instructions and architectural recommendations for your internal engineering team to resolve the vulnerabilities.
5. The Investment & Retesting
Penetration testing is not a one-and-done event. Build in the recurring revenue.
Phase 1: Comprehensive Penetration Test
- Fixed Fee: $[Amount]
- (Includes the active testing window and delivery of all final reports. 50% due upon signing to reserve the testing schedule; 50% due upon report delivery).
Phase 2: Post-Remediation Verification (Optional but Recommended)
- Fixed Fee: $[Amount] (Typically 15-20% of the Phase 1 cost).
- (Once your team has patched the vulnerabilities, we will conduct a focused re-test within 60 days to verify that the critical findings have been successfully closed).
Lock Down Your Quoting Process
When you sell security, your proposal process must reflect the operational maturity you are pitching.
If you send this critical, highly sensitive document as an unprotected Word file, you look like a hypocrite.
Load this template into AutoQuote. This ensures your Rules of Engagement clauses are permanently locked and cannot be accidentally deleted by a junior sales rep. You can generate the proposal instantly, send it via a secure, tracked web link, and require a formal digital signature to authorize the testing window.
Define the targets, limit your liability, and quote the remediation roadmap to turn a one-time audit into a long-term security partnership.