I got three quotes for a penetration test, there's a 4x difference between them — what determines these prices?

experienced the same thing and all pirce inflation. like i think pick the middle one make sure there's a warranty and i asked for a written report. got good service but the agency went silent afterwards

Main reasons for price differences: Number of people (1-2 vs 5-6), Duration (weekly vs monthly), Tools and software licenses, Experience (uncertified vs certified)

90% of what's called 'penetration test' in Turkey is marketing. Mid-sized firms run the same scripts and present different reports. More expensive doesn't guarantee better.

'Scope' is very important in penetration testing. 1) attack from external network, 2) attack from internal network 3) incl. social engineering. Each has a different price.

If you're entering a government tender, choose a firm approved by BILGEM, there's no other way.

I felt relieved reading this answer, so it's not just me. When we decide without measuring, we always end up in the same place.

I'm also curious if anyone does it differently.

We experienced almost the exact same thing last year. When making decisions, write down the worst-case scenario too, not just the best.

Hope this helps.

great work. btw taking notes for two weeks yields better results than a six-month estimate.

correcct me if I'm wrong.

Thanks for posting.

let me summarize what's been said so far. payment information changes are never verified through the channel they came from.

when making decisions write down the worst-case scenario too not just the best but this is my opinion Im not claiming its absolute truth.

I was thinking the same thing... btw if it's your first time start small; scaling comes later.

Just leaving this note it might be useful.

You're right, I've been down that road too. Mistakes made on the penetration test prices side are usually reversible but expensive.

Taking measures without an inventory leaves doors you haven't seen open. Proven by experience.

We need to take it step by step. Hasty decisions become decisions you have to fix six months later.

An automated scan report is not the same as a penetration test.

You're right.

Following. Most time waste accumulates in tasks waiting for approval.

That's all, sorry if I went on too long.

I partly agree, partly disagree. Mistakes made on the penetration test prices side are usually reversible but expensive.

Hope this helps.

Don't miss this: If you scold false alarms, nobody will report again.

If I were you, I'd go this route.

Sorry, but this doesn't apply in every case. If you scold false alarms, nobody will report again.

Proven by experience.