wollopit Got a problem? →

Cyber security software: findings portals & fix tracking

Cyber security firms: findings that actually get fixed. Less PDF, more patched.

The pentest report is 80 pages, the client reads the summary and the fixes live in a spreadsheet nobody owns. Six months later the retest finds the same criticals. We build findings, remediation, assessment and client portal systems for cyber security firms, then we host them and look after them.

Tell us what's slowing you down →Try the live demo →Or call0423 011 252

Looking for security assessment reporting software that gets findings fixed?

A cyber security firm sells two things: finding the problems and getting them fixed. The first part is skilled work. The second usually falls apart the moment the PDF lands in the client's inbox. Findings get copied into a spreadsheet, owners change, the IT provider says it's sorted and nobody can prove it. Meanwhile your testers lose days rewriting the same finding write-ups and chasing screenshots across laptops.

Wollopit builds custom software around how your firm actually runs engagements. Scoping, authorisations, testing, findings, reporting, remediation and retests sit in one place. Clients log in to see their findings, assign owners and mark fixes ready for retest. Essential Eight and ISO 27001 assessments run online instead of in a workbook. We connect the scanners and tools you already use, keep the data locked down and look after it all on our own managed servers.

01The problems

What we hear from cyber security firms

Does your cyber security firm have these problems? Here's how we'd fix them.

Most firms we talk to have brilliant testers and a reporting process held together with Word templates, shared drives and good intentions. It works until three engagements finish in the same week.

  • The problemThe report gets read onceEighty pages of PDF, the exec summary gets skimmed and the technical detail never reaches the person who has to fix it.
    How we fix itFindings live in a portal. Executives get a one-page view and the IT team gets the exact steps for each finding.
  • The problemRemediation lives in a spreadsheetThe client copies findings into Excel, columns drift and nobody knows who owns what or when it's due.
    How we fix itFix tracking per finding with an owner, due date by severity and status the client and your team both see.
  • The problemClients lose momentumThe criticals get patched in week one, then everything else slides until the next annual test.
    How we fix itProgress dashboards, overdue nudges and monthly summaries that keep remediation moving without you chasing.
  • The problemRetests are a scrambleThe client says it's fixed, you dig up the old report, rebuild the scope and retest from memory.
    How we fix itClients flag fixes as ready, retests get booked against the original finding and results update the record.
  • The problemRewriting the same finding againTesters write up missing headers, weak TLS and default creds from scratch on every job.
    How we fix itA findings library with your standard descriptions, risk ratings and fix advice, tweaked per client in seconds.
  • The problemScanner output dumped by handNessus, Qualys and Burp exports get pasted into Word, duplicates and all.
    How we fix itImport scanner results, merge duplicates across hosts and turn them into clean findings with one click.
  • The problemEvidence scattered across laptopsScreenshots, request logs and proof sit on tester machines and in random folders.
    How we fix itSecure evidence storage attached to each finding, with access controls, retention rules and an audit log.
  • The problemScoping by email chainScope, IP ranges, test windows and contacts bounce around in emails until someone loses the latest version.
    How we fix itAn online scoping form, rules of engagement and authorisation letters signed before anyone touches a target.
  • The problemAssessments in a workbookEssential Eight and ISO 27001 assessments run in spreadsheets that get emailed back half filled in.
    How we fix itOnline questionnaires with evidence uploads, maturity scoring and a gap report that writes itself.
  • The problemCredentials sent by emailClients send test accounts and VPN details in plain email because there's nowhere better.
    How we fix itA secure exchange in the client portal for credentials and sensitive files, expiring when the engagement closes.
  • The problemNobody knows who's freeTester bookings live in a calendar and someone's head. Two jobs land on the same senior tester.
    How we fix itAn engagement schedule showing testers, skills, clearances and availability, with clash warnings.
02What we build

Solutions

What we build for cyber security firms. Usually all talking to each other.

Pick the one that's hurting most or join the whole lot up. Everything is built around how your team works, not the other way round.

01

Findings & reporting platform

Findings with severity, CVSS, affected assets, evidence and fix advice, exported to branded reports when you need a PDF.

02

Findings library

Your standard write-ups and remediation advice in one library so testers stop starting from blank.

03

Scanner imports

Nessus, Qualys, Rapid7 and Burp Suite results imported, deduplicated and mapped to findings.

04

Remediation tracker

Owners, due dates by severity, status updates and comments on every finding.

05

Retest workflows

Fixes flagged ready, retests scheduled and results recorded against the original finding.

06

Client portal

Clients log in to see findings, assign owners, upload evidence of fixes and download reports.

07

Executive dashboards

Open risk by severity, fixes over time and overdue items on one page a board can read.

08

Essential Eight assessments

Control-by-control questionnaires, evidence uploads, maturity scoring and gap reports.

09

Compliance questionnaires

ISO 27001, SMB1001 and supplier security questionnaires run online and reused year to year.

10

Scoping & authorisations

Scoping forms, rules of engagement, test windows and signed authorisations before work starts.

11

Engagement scheduling

Testers, skills and availability on one board with utilisation and clash warnings.

12

Secure evidence vault

Encrypted storage for screenshots, logs and client files with retention rules and audit trails.

13

vCISO & risk registers

Risk registers, action plans and monthly reports for retainer clients in their own portal.

14

Quotes to invoices

Scoped engagements turn into quotes, then invoices in Xero once the report is delivered.

15

A website that wins work

Hand-built, fast and clear about your services, built to rank for 'penetration testing' and your city.

03The systems

The big ones

Your whole practice, on one system.

These are the systems cyber security firms ask us about most. Each one works on its own. Joined up, a finding can be tracked from first test to verified fix.

Findings & reporting

Write the finding once. Report it anywhere.

Testers log findings straight into the platform with evidence attached, pulling standard write-ups from your library. The report is generated from the data, so the PDF, the portal and the dashboard always say the same thing.

  • Findings with severity and CVSS scoring
  • Affected hosts, URLs and assets
  • Library of standard write-ups
  • Nessus, Qualys and Burp imports
  • Duplicate merging across hosts
  • Evidence attached to each finding
  • Peer review before release
  • Branded PDF and Word exports
  • Executive and technical views
  • Report versions and sign-off

Remediation tracking

Every finding has an owner and a date.

Once the report is released, each finding becomes a task for the client. Owners get assigned, due dates follow your severity rules and overdue fixes get chased automatically so momentum doesn't die after week one.

  • Owners assigned per finding
  • Due dates set by severity
  • Status updates and comments
  • Overdue reminders by email
  • Jira tickets created for the client's team
  • Accepted risk with sign-off
  • Fix evidence uploads
  • Progress over time charts
  • Monthly remediation summaries

Retests

Retests booked against the original finding.

When the client marks a fix as ready, it lands in your retest queue with the original scope and evidence attached. Testers verify it and the result updates the finding, the dashboard and the report in one go.

  • Client flags fixes ready for retest
  • Retest queue for your team
  • Original scope and evidence attached
  • Pass, partial or fail results
  • Retest letters generated automatically
  • Retest history per finding
  • Billable retests sent to Xero
  • Verified closure on the dashboard

Assessments & compliance

Essential Eight, off the spreadsheet.

Run Essential Eight, ISO 27001 and SMB1001 assessments as online questionnaires the client fills in with evidence. Your consultants review, score maturity and the gap report builds itself, ready to compare against last year.

  • Essential Eight maturity questionnaires
  • ISO 27001 and SMB1001 control sets
  • Supplier security questionnaires
  • Evidence uploads per control
  • Consultant review and comments
  • Maturity scoring by control
  • Gap reports and roadmaps
  • Year-on-year comparisons
  • Reusable answers for repeat clients

Engagements & client portal

Scoped, signed and scheduled before testing starts.

Clients complete scoping online and sign the authorisation in the portal. Credentials get shared securely and your team sees who's testing what and when. Retainer clients get their own risk register and monthly reports in the same login.

  • Online scoping forms
  • Rules of engagement and test windows
  • Signed authorisation letters
  • Secure credential exchange
  • Tester schedule with clash warnings
  • Skills and clearances per tester
  • Client logins with Microsoft 365 sign-in
  • Risk registers for vCISO clients
  • Quotes and invoices to Xero
  • Full audit log of access
04How it changes

Before and after

A penetration test report, wolloped.

Here's how an engagement could change from report to retest. Every firm runs differently, so we map yours first.

Before

  1. Findings written up from scratch in Word
  2. Screenshots hunted down across three laptops
  3. An 80-page PDF emailed to the client
  4. The client copies findings into a spreadsheet
  5. Fixes stall after the criticals
  6. Retest delayed while you rebuild the old scope

After

  1. Findings pulled from your library and tweaked
  2. Evidence already attached to each finding
  3. Client logs in to a portal with the report inside
  4. Owners and due dates assigned per finding
  5. Overdue fixes get chased automatically
  6. Fixes flagged ready and the retest is booked
05Services

Everything under one roof

Software, websites and systems for cyber security firms.

Whether you're starting fresh or upgrading what you've got, it's one team from the first sketch to the support call.

Custom software for cyber security firms

Built around how your cyber security firm actually runs: findings & reporting platform, findings library and the admin in between, in one system you own.

Websites for cyber security firms

Fast, hand-built websites that rank for the searches your customers make and turn visits into enquiries, bookings or orders.

Cyber security firm system upgrades

Running on spreadsheets, old software or a platform you've outgrown? We move your data across and upgrade in stages so the business never stops.

Apps and portals for cyber security firms

Scanner imports and remediation tracker: customer and staff portals that work on any phone without an app store.

Integrations and automation

We connect Tenable Nessus, Qualys and Rapid7 InsightVM so information moves on its own and nobody retypes it.

Hosting, support and care

Managed hosting, updates, backups and security for your cyber security firm, looked after by the people who built it.

06Integrations

Connections

Plays nicely with what you already use.

We connect to the scanners, ticketing and business tools you rely on. If a reporting platform is working for you we build around it. If it's holding you back we'll show you what replacing it involves.

  • Tenable Nessus
  • Qualys
  • Rapid7 InsightVM
  • Burp Suite
  • Microsoft Defender
  • Jira
  • ServiceNow
  • ConnectWise
  • HaloPSA
  • PlexTrac
  • Dradis
  • Vanta
  • Microsoft 365
  • Google Workspace
  • Slack
  • HubSpot
  • Xero
  • Stripe
  • DocuSign
  • Calendly
07How we work

The process

Some people dip their toe in. We turn up in a rebreather.

We get properly below the surface of your cyber security firm: the systems, the busy days and the jobs everyone hates. Then we fix the bits that matter most first.

  1. 01

    Think

    We sit with your testers, consultants and account managers, then follow an engagement from scoping to retest to see where it stalls.

  2. 02

    Archi-tech

    We plan it before writing code: findings, evidence, client access, assessments, integrations, security controls, hosting and cost.

  3. 03

    Build

    Real engineering, shown to you early and often. Usually the most painful bit first, so you get a win before the next big report goes out.

  4. 04

    Look after

    We host it, patch it, monitor it and keep improving it. When something breaks you call the people who built it.

08Questions

FAQ

Things cyber security firms ask us.

Something else on your mind? Ring 0423 011 252 and ask the people who'd build it.

Is client data kept secure?

Yes. Strict role-based access, encryption in transit and at rest, multi-factor sign-in and full audit logs. Clients only ever see their own engagements. We'll walk you through exactly where data lives and how it's protected before we build.

Can it import our scanner results?

Yes. We can import output from Nessus, Qualys, Rapid7 and Burp Suite, merge duplicates across hosts and turn them into findings your testers review before release.

Can we still give clients a PDF report?

Yes. Reports are generated from the findings in your branding, so the PDF matches the portal. Plenty of clients still want the document for their board or insurer.

Can it run Essential Eight assessments?

Yes. Clients answer control-by-control questionnaires with evidence, your consultants review and score maturity and the gap report is built from the answers.

We already use PlexTrac or Dradis. Do we have to switch?

No. If your reporting platform is doing its job we build around it, adding the client portal, remediation tracking, scheduling or assessments it doesn't cover. If it's holding you back we'll show you what replacing it would involve first.

Can the client's IT provider get tickets in their own system?

Usually. We can push findings into Jira, ServiceNow, ConnectWise or HaloPSA so the people fixing things work in the tools they already use.

How much does a system like this cost?

It depends on what you need, so we quote up front once we understand it. No surprise invoices, no lock-in and you own what we build.

How long does it take?

Smaller jobs like a client portal or remediation tracker can be quick. Bigger systems are planned in stages so you get the first win early instead of waiting for everything at once.

Who looks after it once it's built?

We do. We host it on our own managed servers, keep it patched and monitored and fix things fast. When you need something you ring the people who built it.

We already have systems. Can you upgrade them instead of starting again?

Usually, yes. Most cyber security firms we work with keep what's working and upgrade the rest in stages. We move your data across, connect the old and new while we switch and retire the old system only when the new one is proven.

Contact

Got a cyber security firm problem? Consider it wolloped.

Tell us what's slow, broken, manual or missing. You don't need a spec, just describe what's going on.

Call0423 011 252 Emailprojects@wollopit.com.au
I've got

We also build for