For cybersecurity consultants
In security work, the scope isn't paperwork. It's permission.
Independent security consultants sell assessments, penetration tests, policy and compliance readiness work, and fractional security leadership. The proposal does more than set a price: it defines which systems you may test, when, how, and who has authorised it. A vague scope isn't just a commercial risk — testing something the client didn't own or approve is a serious problem. And after the report, the client wants a free retest of everything, months later.
ApeiroCraft sends the engagement as a link with in-scope and out-of-scope assets, testing windows, rules of engagement, the authorising contact, deliverables and retest terms. You see when it's opened and reopened, the authorised person signs in the browser, and the engagement is invoiced from the accepted proposal.
Where security engagements go wrong.
Unclear scope
An IP range includes a third-party host, a subdomain belongs to a supplier, a cloud tenant is shared. If the scope isn't explicit, you can't test with confidence.
Authorisation from the wrong person
A manager approves a test of systems they don't control. The signer needs to be someone who can authorise it — and the record needs to show who that was.
Endless retests
The report goes out; months later the client wants a retest of everything after fixing half of it. Without retest terms, it's expected free.
Scoping call to final report.
Scope and rules in one place
List in-scope and excluded assets, testing windows, methods excluded (such as denial-of-service or social engineering), and emergency contacts.
See when it's in review
Opens and re-opens are recorded on the link. Reopens often mean the scope is with the client's IT or legal team.
A record of the acceptance
The signature records name, email, IP address and a UTC timestamp and can't be altered afterwards — a clear record of when the scope was accepted, and by which name and email.
Invoice on signing or report
Convert the accepted proposal to a draft invoice for the deposit, and again on delivery of the report. Fractional retainers are invoiced monthly.
What a security assessment proposal has to include.
Many testers use a separate authorisation document reviewed by the client's legal team. Whether or not you do, the proposal should cover these.
In scope and out of scope
If it's left vague
Third-party or shared assets get tested by accident.
With ApeiroCraft
List assets in scope, explicitly name exclusions, and confirm the client controls what's in scope.
Rules of engagement
If it's left vague
A test disrupts a production system during trading hours.
With ApeiroCraft
State testing windows, methods excluded and how you'll stop if something breaks.
Authorisation
If it's left vague
The person who approved it couldn't.
With ApeiroCraft
Name the authorising person and their role, and require them to sign.
Deliverables
If it's left vague
The client expects a remediation project, not a report.
With ApeiroCraft
Describe the report, the debrief, and that remediation is out of scope unless quoted.
Retest and confidentiality
If it's left vague
Unlimited free retests, and unclear handling of findings.
With ApeiroCraft
Give the retest window and scope, and how findings and data are handled and destroyed.
- Deposit and report invoices from one accepted proposal.
- Private notes per engagement — kept inside your workspace.
- Fractional security retainers sent as separate proposals.
Common questions.
How do independent security consultants usually price?
Common models are fixed-price assessments based on scope (number of applications, hosts or users), day rates for testing and consulting, monthly retainers for fractional security leadership, and fixed fees for policy or compliance readiness projects. ApeiroCraft holds the model; it doesn't suggest rates.
What does a web application test proposal look like?
One named web application and its API in a staging environment; production and third-party payment pages excluded; testing during a five-day window outside business hours; no denial-of-service testing; an emergency contact; the client's head of IT as the authorising signer; a report with findings and a debrief call; one retest of fixed findings within a set number of days; findings handled confidentially and data deleted after a stated period. The head of IT signs, and you invoice the deposit.
When is ApeiroCraft not the right fit for security work?
It doesn't produce reports, track findings or manage vulnerabilities, and it won't satisfy every client's procurement or legal requirements for authorisation — some will insist on their own documents. It fits the proposal, the signature record, invoicing and client notes for independent consultants.
Is an e-signature enough as authorisation to test?
That depends on your jurisdiction and the client. ApeiroCraft records the signer's name, email, IP address and a UTC timestamp, and the signed document can't change. Many consultants also use a separate authorisation letter reviewed by the client's legal team.
Should I store findings in ApeiroCraft notes?
Keep sensitive findings in a system designed for them. Use ApeiroCraft notes for engagement logistics rather than vulnerability details.
Make the scope the first thing they sign.
Start from the consulting template and add your rules of engagement.
Start freeStill deciding? Talk to the founder
Keep reading
Free template
Consulting proposal template
A sharpened problem statement, phased approach with a stop option, and value-anchored fees.
Solution
ApeiroCraft for consultants
Scope, phases, and value-anchored fees in a document that gets signed, not edited.
Guide
Are e-signatures on proposals legally binding?
ESIGN, UETA, eIDAS — what actually makes a signature hold up, and what to capture.