They told us to "get a web pentest" — what is this exactly, and is it really necessary for our website?

unfortunately, you run into bureaucratic roadblocks like this all the time with large enterprise clients. like it's not the buyer interested in your furniture who cares; their IT director makes that checklist mandatory and if you want the job, you usually have no choice but to get the report.

Correction: I misremembered the figure, it was a bit lower.

We faced the exact same demand last month for our 8-page brochure site. The first quote was 30,000 TL. We scoped it strictly to a single domain and static forms, got billed 12,000 TL for two days of work, handed over the report, and the contract was approved.

Paying 25,000 TL for a pentest on a static site that doesn't process payments is a total waste of money. Send the hotel's procurement officer a formal letter explaining that the site has no user accounts or database and only features a contact form. They might give you an exemption.

The process roughly goes like this: 1) You provide the security firm with your site URL and stack details. 2) The experts perform simulated attacks on your site. 3) They compile discovered vulnerabilities and remediation steps into a report. 4) Your hosting provider patches the issues, and the final verification report is submitted to the client.

Make sure to ask any firm quoting you how many days it will take to deliver the report and whether a re-test after fixing the vulnerabilities is included in the price. Some firms charge extra for that second review.

if it's literally just a contact form take it down and replace it with an email address. ask the client if that gets you out of the pentest requirement imo.

If the profit margin on the hotel contract easily covers the cost of this test, just get it done without dragging things out. Enterprises rarely make exceptions to security protocols, and if you push back, they might just go with another vendor.

There's a common mistake people make when doing this. Your time to detect an issue directly determines its cost.

Taking measures without an inventory leaves doors you haven't seen open. If you post the result here, it will help others too.

Good call starting this thread.

There's also a measurement aspect to this. When making a decision, first look at what data you have on hand.

Proven by experience.

Here's how it went for us. The real issue isn't the number, but what it's based on.

If I were you Id go this route.

Could you elaborate on that? Everything goes well for the first three months; problems arise in the fourth.

Most time waste accumulates in tasks waiting for approval. Correct me if I'm wrong.

Id appreciate it if you shared the outcome.

I have a question, don't want to go off-topic though. When you try to change everything at once, nothing settles.

The opposite happened to me, that's why I'm writing. Taking notes for two weeks yields better results than a six-month estimate.

That's all, sorry if I went on too long.

I'd say don't rush. Your time to detect an issue directly determines its cost.

Here's how it went for us. An untested backup is not a backup.

I'm also curious if anyone does it differently.

You're right I've been down that road too. If permission and scope aren't in writing don't start that test.

I'm also curious if anyone does it differently.