How to Invoice as a Cybersecurity Consultant
The lines a security assessment, penetration test or incident response invoice needs, in what order, on which payment terms, and how to chase a late payment.
On its page for information security analysts, last modified August 27, 2026, the US Bureau of Labor Statistics says "Information security analysts plan and carry out security measures to protect an organization’s computer networks and systems." A consultant doing that work for clients can charge for it in one of two ways: a fixed fee for a defined engagement, such as an assessment or a penetration test, or an hourly rate for open-ended work, such as incident response or advisory time.
The invoice should name the engagement and its scope in the client's terms, list each deliverable or block of hours as a separate charge, show any costs you're passing on, and state the payment terms. Keep technical findings out of the invoice itself; reference the report by name and date instead, so the invoice can go to a client's accounts team without exposing sensitive detail.
Worked example, with sample figures before any tax: a client books an external penetration test at a fixed 6,000.00 plus advisory calls billed at 175.00 an hour. The consultant logs 6 advisory hours, 6 × 175.00 = 1,050.00, for a total of 6,000.00 + 1,050.00 = 7,050.00. The invoice splits that into two payments, 50% at kickoff and 50% on delivery of the report: 3,525.00 + 3,525.00 = 7,050.00.
Step-by-step invoicing guide
- 1
Agree on the scope and price before testing starts
Send an estimate that names the systems in scope, the test window and the deliverables. Billed's help article on estimates says: "You can make an estimate and then send it to your client. Your client can approve it to proceed further." Once the client approves, Billed's invoice software page explains how to "convert an approved estimate into an invoice".
- 2
Pick fixed fee or hourly for each part of the work
Consider a fixed fee for a defined assessment; Billed's projects page says: "You can add as many tasks as you need in the flat rate project. Invoice your client for the project from the dashboard whenever you want." Open-ended work such as incident response can go on an hourly rate project, where Billed's time tracking page says: "Create an hourly rate project, set its hourly rate, and Billed tracks the charge for each task as you log it. From the project dashboard you can invoice one task or several at once."
- 3
List each deliverable as its own charge
Name the assessment, the retest and any advisory hours on separate lines, so each charge lines up with the statement of work. Billed's help center article on creating invoices says to add a line item and "fill this section to charge against new items and services."
- 4
Add agreed costs you covered for the client
If you paid for travel or a tool license that the client agreed to cover, log it in Billed as an expense under that client. Billed's help center article on creating invoices says: "If there are any unbilled expenses of a particular client, you can add these expenses to the client's next invoice. The expense will appear as a line item in the invoice."
- 5
Set terms, send and follow up
Billed's invoice software page says to "Set a due date on each invoice so your client knows when to pay." It adds: "Invoice reports show which invoices are paid, partially paid or past due, and you can see who owes you money and send them a payment reminder." Reference the report by title and date on the invoice instead of copying findings onto it.
Tips for cybersecurity consultant invoicing
- Split a large engagement into payments on one invoice, for example one payment at kickoff and one when you hand over the report.
- Name the report the invoice relates to, with its date, so the client's approver can find it without asking.
- Bill a retest as its own charge, so it isn't mistaken for part of the original fixed fee.
- For incident response billed by the hour, export the timesheet and send it with the invoice.
- Keep vulnerability details off the invoice, since it can travel through the client's finance team.
Common invoicing mistakes to avoid
- Starting a test before the scope and price are approved in writing.
- Folding retests and extra advisory hours into the original fixed fee without saying so.
- Copying findings onto the invoice, where people outside the security team may read them.
- Leaving travel and tool costs off because they weren't recorded against the client at the time.
How this works in Billed
Estimates the client approves
Billed's help article on estimates says: "You can make an estimate and then send it to your client. Your client can approve it to proceed further."
Fixed-fee and hourly projects
"You can add as many tasks as you need in the flat rate project. Invoice your client for the project from the dashboard whenever you want." (Billed's projects page).
Timesheets for clients
Billed's time tracking page says: "Create timesheets from the time you and your team have tracked to see how the team is spending its time, and export them when a client or your accountant needs a copy."
Payments in installments
Billed's help article on scheduled payments says: "You can let your clients pay the amount in installments through this option."
Card and PayPal payments
"Connect your Stripe account and every invoice you send gets a pay button, so clients can pay by card." (Billed's invoice software page). For PayPal, Billed's payments page says: "Add your Paypal account to Billed to start accepting payments via Paypal on your invoices."
Reports and reminders
Billed's invoice software page says "Invoice reports show which invoices are paid, partially paid or past due, and you can see who owes you money and send them a payment reminder." It adds: "Payment reminders can be customized."
Frequently asked questions
Start Invoicing With Billed
Set up your account and send your first invoice with Billed.
At a glance
| Part of the engagement | How to bill it |
|---|---|
| Assessment or test | Fixed fee |
| Retest | Its own fixed charge |
| Incident response | Hourly, from tracked time |
| Travel or tools | Client expense on the invoice |
When this isn't for you
This guide is for consultants who bill clients directly. If a reseller or managed-service provider invoices the end client for your work, follow that firm's billing process instead.