One register for scoped engagements, findings, retests, retainers and resold licences.
Manage security assessments, tester allocation, findings, report review, retests, monitoring retainers and resold licence renewals in one system. The signed scope, the test window, the named testers and every finding stay on one engagement, from first log to verified fix. Commercial staff see hours and renewals. Testers see their own work. Client evidence stays limited to the people on that engagement.
- Scope forms, severity scale and report stages entered the way your firm works
- Client list, open engagements and licence renewals migrated
- Changes to severity scales and report templates handled by GullySystem staff when asked
Cybersecurity Company Management Software carries the engagements of penetration testing firms, security consultancies and managed monitoring providers, and the GullySystem team configures it. Each engagement holds its signed scope, test window, named testers, findings with evidence, report versions and retest status. Retainer hours count against the contract, and resold firewall, endpoint and email licences carry a renewal date per client.
What goes wrong before the software.
How the work flows through it, step by step.
- 1
Enquiry and scoping
A prospect asks for a web application test, a cloud review or a monitoring plan. A scoping questionnaire is sent, targets and constraints are recorded, and the proposal is built from the firm’s own day rates.
- 2
Signed scope and authorisation
The accepted proposal becomes an engagement. The signed scope, permitted dates, source addresses and client contacts are stored, so every tester works against the same written rules.
- 3
Allocation and testing
The delivery lead picks testers from the bench by skill and free days. Testers log findings as they go, each with an affected asset, a severity, evidence and a suggested fix.
- 4
Review and report
A reviewer checks every finding, adjusts severity on the firm’s scale and approves it. The report is assembled from approved findings, and each issued version is kept with its date and approver.
- 5
Retest and closure
The client reports fixes. Each finding is retested and marked fixed, accepted as a risk or still open, and the retest letter is produced from those results.
- 6
Retainer and renewals
Monitoring hours are logged against the plan, and resold licences are listed by client with their vendor dates. The renewal quote is prepared before the date, not after it.
What is inside.
Every module can be switched on, left out or changed to match how your team already works.
The business modules it is built from.
Each one is also available on its own, or inside a system built for you.
- Quote & Proposal Management
Proposals are built from the firm’s own day rates and test types, and each revision is kept beside the scoping questionnaire answers.
- Contract Management
The signed scope, permitted dates and excluded hosts are held as the agreement that testers and reviewers read before work begins.
- Resource Allocation
Free days, specialities and booked weeks of each tester are shown, so a start date is promised only when the right person is available.
- Workflow and Approvals
A report moves from draft to reviewed to approved, and the reviewer’s name and date are written against each issued version.
- Ticket Management
Each escalated alert becomes a numbered ticket with an owner, severity, response notes and the client contact who was informed.
- Project Time Tracking
Hours for alert handling, advisory calls and tuning are logged against the client’s monthly plan and shown as used and remaining.
- Service Reminders
Reminders fall ahead of each vendor date, so the renewal quote for a firewall or endpoint licence is out before cover ends.
- Audit Trail
Every view, edit and download of a finding or report is logged with the person and time, which answers a client’s question about who saw evidence.
How we would put it in.
Setup, data migration, integrations and anything built on top.
One system, each person sees their part.
For the founder or practice head
Read engagements by stage, bench use, retainer overruns, renewals due and open invoices together. Decide hiring and pricing from the firm’s own figures.
For delivery leads
Allocate testers to engagements, watch test windows close, and chase reviewers when findings wait too long for a severity check.
For penetration testers and analysts
Open the scope, log findings with evidence as they appear, and see the retests assigned to you. Notes stay on the engagement and not in a personal folder.
For reviewers
Check findings, set severity on the firm’s scale and approve the report version that goes to the client.
For account managers
Track quotes, retainer usage and licence renewals per client, and send the renewal quote before the vendor date arrives.
The numbers the owner asks for.
- Engagements by stage, test type and assigned tester
- Findings by severity, affected asset and status
- Reports awaiting review, with the reviewer and days waiting
- Retests requested, done and still open, by client
- Retainer hours used and remaining, by client and month
- Licences and subscriptions due for renewal, with quote status
- Tester bench use against booked and free days
Who this is built for.
- Penetration testing and red team firms that sell scoped assessments
- Security consultancies that run audits, architecture reviews and awareness training
- Managed detection and monitoring providers that sell hours or seats on a retainer
- Resellers of firewall, endpoint and email security licences
- Boutique firms that mix assessments, retainers and licence resale for the same clients
When it is not the right choice.
- A solo consultant with two or three clients a year can run on a proposal template and a folder of reports.
- Product companies that build and sell their own security software will find SaaS Company Management Software closer.
Adapted to your business before it goes live.
You are not handed a login and left to it. The product is set up around your records, your people and the tools you already use.
Works alongside
- Calendar
- Ticketing or monitoring alert feed
- Document signing
- Accounting export
- Messaging for client updates
Questions owners ask before a demo.
Does it replace our testing tools?
No. Scanners and proxies stay where they are. The system holds what they produce once a tester has judged it: the finding, its evidence, its severity and its status.
Can a tester see another client’s findings?
Only if named on that engagement. An engagement is opened to its own testers and reviewers, and every view or download of a report is logged against a person.
How are retests handled?
Each finding has its own status. When a client reports a fix, the retest is scheduled and the result is recorded per finding, then the retest letter is built from those results.
Do retainers and one-off tests fit together?
Yes. A client can hold a fixed-fee assessment and a monthly hours plan at once. Hours are logged against the plan, and the assessment is billed by milestone.
How are resold licences tracked?
Each licence is listed with its client, vendor, seat count and renewal date. A quote is prepared ahead of the date, and the order is marked once the vendor confirms.
Does it work for a firm in several countries?
Yes. Each billing country gets its own currency, tax lines and invoice wording, and your accountant reads a sample invoice before go-live. Report language is chosen per engagement.
Does a quote show the tester days it needs?
Yes. The proposal is built from your day rates and the testers likely to be allocated, so the days promised can be compared with the bench before the client signs.
What does a demonstration look like?
We open a sample engagement from scoping to retest, using your own test types and severity names, before any figure is discussed. Cost follows from users, modules and setup, in a written proposal.
How is the evidence we hold protected?
Access follows named roles, downloads are logged and files can leave only as protected downloads. Retention periods and encryption choices are set with your security officer during implementation.
Is our findings history exportable later?
Yes. Engagements, findings and report versions come out as spreadsheet or document files, and the layout you need is named in the quotation before testing begins.
Wondering what it would cost? Share your requirements and an engineer will come back with a scope.
Businesses that use this.
See Cybersecurity Company Management Software with your own data.
Tell us how you run things today. We’ll show you the parts that matter to you and say plainly what would need changing.
- No obligation
- A reply within one business day
- Your details stay private
Start with your requirements
Seven short steps that tell us what you need. An engineer reads them before getting in touch.
Share your requirements