I want to hire a security consultant, what criteria should I use to choose, what's the price, how do I find a good one

we also struggled when choosing... we decided after checking the references

Let me speak from the other side; I'm on the supplier side. Taking measures without an inventory leaves doors you haven't seen open.

If you get three different answers on a topic, the question was asked wrong.

could you elaborate on that? if you scold false alarms nobody will report again.

just leaving this note, it might be useful.

There's one point I'm curious about. Everything goes well for the first three months; problems arise in the fourth.

I'm also curious if anyone does it differently.

Quick summary for newcomers: An untested backup is not a backup.

Just leaving this note, it might be useful.

I have an objection here. Payment information changes are never verified through the channel they came from.

If permission and scope aren't in writing, don't start that test. Proven by experience.

I'm writing this so you don't make the same mistake. If you get three different answers on a topic, the question was asked wrong.

I'd appreciate it if you shared the outcome.

I went through the same thing two years ago. If 2FA is on, a stolen password alone is useless.

If I were you, I'd go this route.

I disagree with you on this point. Security isnt absolute; its about making attacks not worth the effort.

we experienced almost the exact same thing last year then mistakes made on the choosing a security consultant side are usually reversible but expensive.

There's also a measurement aspect to this. Don't hesitate to ask; those who don't ask always pay more.

People defend habits, not processes. Resistance comes from there. This is my opinion, I'm not claiming it's absolute truth.

Thanks, that was the answer I was looking for.

I'm a small business, let me explain from my side. The harder it is to reverse a decision, the slower you should make it.

If you have questions, write them; I'll answer as best I can.

The discussion got scattered, let me summarize. Don't hesitate to ask; those who don't ask always pay more.

I agree, and I'd like to emphasize that. Don't hesitate to ask; those who don't ask always pay more.

Proven by experience.

Let me share what happened to me; it might be useful. If 2FA is on, a stolen password alone is useless.

Trying to do this alone is the most expensive way. Hope this helps.