A prospect asking for “cybersecurity help” might need a first risk assessment, an authorised penetration test, a configuration project or emergency incident response. For a cybersecurity consulting agency seeking new business, the challenge is to qualify the type of work before writing a proposal. A vague brief is not a licence to promise comprehensive security.
Eight qualification signals to capture
- What triggered the enquiry: a customer requirement, procurement, internal audit, incident or system change?
- Which environments are involved: cloud, identity, endpoint, network, applications or operational technology?
- What deliverable is expected: assessment, penetration test, remediation, training or managed service?
- Which systems and data can the provider lawfully access, and under what conditions?
- Who owns security internally, who is the technical contact and who approves spend?
- Is this planned work or an urgent situation requiring specialist response coverage?
- Which contractual or regulatory requirements has the buyer identified?
- Is there a budget, delivery window and owner for follow-up remediation?
Four types of work that should not share one generic quote
- Risk and maturity assessment: identify assets, governance gaps and priorities; implementation is a separate decision.
- Penetration testing: agree authorised targets, rules of engagement, test windows, reporting and retesting.
- Security implementation: identity, logging, backup and hardening require change authority and operational ownership.
- Managed security: monitoring, incident processes and service levels demand a different operating model from a one-off review.
Use frameworks to scope, not to overclaim
NIST Cybersecurity Framework 2.0 provides a structure for discussing governance, identification, protection, detection, response and recovery. It does not mean a single consulting engagement can certify a client as “fully secure”. Ask buyers to identify their own contractual and regulatory obligations and the person accountable for legal interpretation. NIST’s small-business quick-start guide is a useful reference for initial scoping.
Move from enquiry to a deliverable statement of work
When the environment is unclear, sell a bounded discovery stage before committing to implementation or testing. Define systems in and out of scope, written authorisation, access, test methods, handling of sensitive findings, reporting format and escalation paths. State whether remediation and retesting are included. If a client expects a security guarantee, explain the limits of any assessment rather than burying them in the contract.
Questions for the first discovery call
- What business decision or risk will this engagement address?
- Which systems are explicitly in and out of scope?
- Who can authorise testing of every affected environment?
- Who will receive, prioritise and remediate findings?
- What is the response process if testing causes disruption or reveals an active incident?
- What evidence will you need after delivery: report, workshop, retest or handover?
- Who approves the budget and accepts residual risk?
When the right answer is no
Decline or hold enquiries that lack permission to test systems, seek unauthorised access to third-party infrastructure, cannot appoint a recipient for sensitive findings or demand a guarantee against future breaches. An active incident may require a dedicated response provider rather than a general consultancy. Mosai’s buyer-facing cybersecurity category helps businesses understand provider types; this page is for agencies qualifying opportunities.
How Mosai fits into business development
Mosai for agencies helps suppliers describe their services and preferred project fit. The Swedish pricing model includes Free at SEK 0/month, Partner at SEK 995/month with priority matching when fit is relevant, and an SEO & AEO agent at a SEK 600/month launch price with ongoing review and two relevant new pages per week. No lead volume or outcome is guaranteed. Check pricing and how leads are developed for the broader offer.
Define the work you actually want
Document supported environments, exclusions, discovery requirements, remediation ownership and delivery availability. A strong qualification process protects both your team and the client’s security posture. Not every inbound enquiry deserves a proposal.