Security consultancies, pen testers and managed security providers

The CRM for cybersecurity firms.

GuardenerAI for cybersecurity firms is a CRM for security consultancies, penetration testers and managed security providers. It runs the sales pipeline for assessments and retainers, tracks engagements as a custom object, sends statements of work for e-signature from the client contact, and invoices the work from the same system. It is for small security teams that sell on trust and expertise.

Security work is sold to cautious buyers over long conversations, then delivered as engagements with scopes, dates and findings. When the deal sits in one tool, the engagement in another and the invoice in a third, follow-up slips. GuardenerAI keeps the client, the engagement and the money together.

Sound familiar?

What this usually looks like today.

What changes

One system, doing the work with you.

A pipeline for assessments and retainers

Penetration tests, audits and managed retainers run as opportunities with value, stage and expected close date, and recurring line items carry monthly value for retainers.

Engagements as real records

An Engagements object holds the scope, type, start and end dates and status for each piece of work, linked to the client company.

Statements of work signed from the record

Send the SOW from the client contact’s record. They sign on any device, your practice lead countersigns, and the sealed PDF is filed on the person.

Delivery follow-up that happens

An action plan lays down the kickoff, report delivery, debrief and retest tasks on every won engagement, each with its own due date.

The modules this runs on

How you set it up

Shaped around how cybersecurity firms actually work.

There is no one-click template for this industry, so you add these objects and fields yourself in Settings. It takes an afternoon, and nothing about it is fixed.

You create it

Engagements

One record per assessment, audit or retainer period, linked to the client company. You create it in Settings.

  • Client
  • Engagement Type
  • Scope
  • Start Date
  • End Date
  • Lead Consultant
  • Status
Built in

Opportunities

Each proposed engagement or retainer, with one-time and recurring lines.

  • Value
  • Stage
  • Expected Close Date
  • Line items
Built in

Companies and Persons

Client organisations and their security, IT and finance contacts.

  • Rating
  • Industry
  • Employee Count
Built in

Cases

Client questions and requests after delivery, worked from a shared queue.

  • Priority
  • Type
  • Origin
  • Status

Suggested stages on Opportunities

  1. Prospect
  2. Scoping call
  3. Proposal
  4. SOW sent
  5. Closed Won
  6. Closed Lost
Routines to copy

The repeat work, set up once.

Each of these is built from features in the product today. Set them up once and the whole team runs them the same way.

Action plan

Engagement delivery

  1. Apply it to the client company when an engagement is won.
  2. Day 0: kickoff call and access checklist (high priority).
  3. Day 10: draft report review.
  4. Day 14: report delivery and debrief call.
  5. Day 90: offer a retest.
Signature template

Statement of work

  1. Write the SOW once, with the client contact’s name, your firm’s name and the date merged in.
  2. Add the scope and fee in the request before sending.
  3. The client signs; your practice lead countersigns.
Saved report

Client requests queue

  1. Log client questions and requests as cases with priority and type.
  2. Assign them to a shared queue so whoever is free claims them.
  3. Save a report of open cases grouped by priority for the weekly review.

Built for buyers who read the security page.

Each workspace is isolated and encrypted, every change is audit-logged, and roles are default-deny. We describe what is in place on our security page, and an ISO 27001 control mapping can be walked through under NDA.

Read the security details →
FAQ

Questions from teams like yours.

Can we store findings and reports in GuardenerAI?
You can attach files to client and opportunity records, but GuardenerAI is not a vulnerability management or reporting tool. Most firms keep findings in their own tooling and attach the final report.
Do you hold SOC 2?
Not today. An ISO 27001 Annex A control mapping exists and can be shared under NDA, and a SOC 2 audit can be scoped on a customer’s requirement.
Can we track retainers?
Yes. Retainers sell as opportunities with recurring line items that show monthly and annual value. Invoices are raised by hand each period; there are no recurring invoices.
Can clients sign SOWs with several signatories?
Each request has one client signer plus an optional countersigner from your side. If two client signatories are needed, send a request to each.

See it on your kind of work.

Start free in an afternoon, or have us walk you through it with data that looks like yours.

Book a walkthrough

Tell us about your team and what you want to see, and we'll reply by email to set a time.

No spam.