The Solo Consultant's Dilemma
An independent cybersecurity consultant in Reading had built a successful practice over fifteen years. Penetration testing, security audits, compliance reviews — he was good at what he did. But every engagement involved hours of work that wasn't really security work.
"For every hour I spend actually testing a system, I spend another hour writing up the findings," he said. "Then there's the scoping documents, the compliance checklists, the executive summaries that translate technical findings into language a board can understand. All necessary. All time-consuming. All pulling me away from the work I'm actually expert at."
What We Configured
We deployed OpenClaw on a hardened, air-gapped Mac Mini in his home office — security consultants have exacting standards for their own infrastructure, understandably. The agent was configured with three primary functions:
- Report generation — after a penetration test or audit, the consultant inputs raw findings (vulnerability IDs, severity ratings, evidence). The agent generates a structured report in his standard format, including technical details, risk assessments, and remediation recommendations.
- Executive summaries — a separate agent takes the technical report and produces a board-ready executive summary, translating CVSS scores and technical jargon into business risk language.
- Compliance mapping — for clients undergoing ISO 27001 or Cyber Essentials certification, the agent maps findings to specific control requirements and generates gap analysis documents.
The Quality Bar
A cybersecurity report with errors is worse than no report at all. The consultant was rigorous about validation:
"I spent the first two weeks checking every single output against what I would have written myself. The technical accuracy was solid — it knows the CVE database, it understands OWASP, it can reference NIST frameworks correctly. The remediation advice was occasionally generic, so I tuned the prompts to include client-specific context. After that, I'd say it gets to 85% of where I need it, and I spend 15% of the original time polishing rather than writing from scratch."
The Impact
Report writing time dropped from 4-6 hours per engagement to about 1 hour of review and refinement. Over a typical month of 8-10 engagements, that's 30-50 hours reclaimed.
He used that time to take on more clients. Revenue increased by roughly 40% in the first quarter — not because he was working harder, but because the bottleneck (report writing) had been removed.
"My clients get better reports, faster," he said. "I get to do more of the work I actually enjoy. And I sleep better because I'm not up until midnight formatting tables. Everyone wins."