Get early access

Client security reporting in your brand

Fix notices your team approves, a monthly digest for each client, and a portal that shows what you did. Sent from your domain. Kept as evidence.

Get early accessMopokeHQ for agencies

What a client notice looks like

An example. Ferncourt Digital, Harbour Dental, the package and the advisory are all made up.

  • The new advisory was matched against the booking app’s stored SBOM. No rescan.
  • The vulnerable version was running in production, so the exposure was Confirmed live.
  • High severity, not known to be exploited: P2, with a 14 day SLA.
  • The exposure closed on its own when the fixed version was seen deployed.
  • Lilly drafted the notice. Sam changed one line and sent it. The sent message is stored as evidence.
From
Ferncourt Digital <[email protected]>
To
Jo, Harbour Dental
Subject
Fixed: a security update to your online booking system

Hi Jo,

We have fixed a security issue in the online booking system we run for Harbour Dental. You don’t need to do anything.

What we found

On Friday 2 October, a security advisory was published for a code library your booking system uses to read form submissions. A specially crafted request could make the booking page slow or unavailable. The flaw did not give anyone access to patient records.

Was it used against you?

We found no signs that it was.

What we did

  • 2 October Our monitoring matched the advisory to your booking system the day it was published.
  • 5 October We upgraded the library to the fixed version and tested the booking flow.
  • 6 October, 10:42am We confirmed the fixed version was running on your live site.

Our agreement allows 14 days for issues at this priority. This one was closed in 4.

Technical details for your IT contact

System
Online booking app (Laravel), production
Package
example/form-parser 4.2.1 to 4.2.2
Advisory
CVE-2026-XXXXX (example)
Priority
P2, high severity, not known to be exploited

Sam
Ferncourt Digital

AI Drafted by Lilly, edited by Sam
Approve and sendEdit draft

Drafted for you, sent by you

A notice is drafted when an issue is fixed and the fixed version has been seen in a deployed environment. Lilly, the AI, writes the first draft in plain language. A person on your team approves and sends it.

At discovery or at resolution

By default, clients hear from you once the fix is live. Some contracts require notice as soon as an issue is found. Set that per client.

A monthly digest for each client

Fixed and confirmed live, still open with due dates, external checks run, notices sent. Built from a fixed template, so the same facts always produce the same report, on a schedule you set.

A portal in your branding

Your logo and name replace ours. Each client sees what you did for them. Viewers are unlimited, so the practice manager, the owner and their IT contractor cost nothing extra.

Sent from your domain

Notices and digests go out from your own domain, signed with DKIM. Your client sees your name, not ours.

Every message is evidence

Each sent message lands in the hash-chained evidence log. When a client’s auditor or insurer asks what you did and when, the evidence pack answers in your branding.

When the template stops

If there are signs of actual compromise, MopokeHQ stops the template flow and flags a possible incident. A person takes over, and your client may need to start an assessment under the Notifiable Data Breaches scheme.

Fixed, no sign of use
Template notice, approved by a person
Signs of compromise
Template stopped, possible incident flagged
Assessment
Within 30 calendar days for organisations covered by the Privacy Act

Questions about client reporting

What should a monthly security report for clients include?

What was fixed and confirmed live, what is still open and when it is due, what external checks ran, and which notices you sent. MopokeHQ builds each client’s monthly digest from a fixed template, so the same facts always give the same report.

How do I tell a client about a vulnerability?

Say what was found, whether there is any sign it was used, what you did with dates, and what the client needs to do, which is often nothing. Keep technical details in a separate block for their IT contact. MopokeHQ drafts this when the fix is confirmed live, and a person on your team approves it before it is sent.

Should we tell clients when we find a vulnerability, or only after it is fixed?

That depends on your agreement with each client. MopokeHQ notifies at resolution by default, and you can switch individual clients to notice at discovery.

Does AI send messages to our clients?

No. Lilly, MopokeHQ’s AI, drafts the notice, and a person approves and sends it. Nothing Lilly writes sends itself.

Is a vulnerability a data breach?

Not by itself. Under the Notifiable Data Breaches scheme, an eligible data breach involves unauthorised access to or disclosure of personal information that is likely to cause serious harm, where remedial action has not prevented that harm. If MopokeHQ sees signs of actual compromise, it stops the normal notice template and flags a possible incident so a person can start the assessment.

Do client portal viewers cost extra?

No. Users are unlimited, including client portal viewers.

Put a mopoke on night watch

One job in your CI pipeline. Your first SBOM is matched against every advisory we hold within minutes.

Get early accessSee how it works