They asked for a "pentest / penetration test" — what does it mean, and does a small business like ours really need one?

When there's a 1,800,000 TL annual contract on the table, don't view a 35,000 TL penetration test as an expense. Audit teams at enterprise clients will never sign a contract without this report. If you refuse, they walk away and the deal goes straight to a competitor who checks that box.

Define the scope carefully when getting quotes. To keep the cost down, only include the web portal domain your dealers access and the API endpoints; exclude your office network or company mail servers. Make sure the test is performed using a "gray box" approach with an actual dealer user account provided to them.

Last year we paid 40,000 TL to get one done just to land a deal with a supermarket chain. During the test, it turned out a dealer could download another dealer's entire order history by changing a single parameter. Thank goodness we did it; the commercial reputation hit we'd have taken with our dealers from a data leak would have cost way more than that.

Things to watch for when signing with the firm: 1) Put it in the contract that the assigned specialist holds valid cybersecurity certifications (TSE or international equivalents). 2) Ask them to run the tests outside business hours or on a staging server so they don't lock up your database. 3) Confirm that the re-test after remediation is included in the price.

There are plenty of firms out there that just run an automated tool and hand you a 15-page English printout calling it a report. If you drop 35,000 TL on what turns out to be an off-the-shelf scanner dump, the client's infosec team will reject it instantly. Ask the quoting firm point-blank how many hours of manual business logic testing they will perform.

whatever you do do not send the initial report to the client then the first report is definitely gonna have critical vulnerabilities flagged in red. i mean your dev will fix them the security firm will re-check and sign off and then you send the clean executive summary to the client.

Corporate entities requiring independent security audits from vendors is a compliance obligation under KVKK and information security management standards. The cost of the requested assessment represents reasonable operational due diligence when weighed against the administrative fines and civil liability that could stem from a potential data breach.

Send the scope in writing to the firm offering 35,000 TL and lock in a contract that includes the re-test. Then send an official note to your client immediately saying "Our penetration test has been scheduled and the report will be delivered to you within 10 days." That way, the contract timeline on the client side stays on track without delays.

I'm a small business, let me explain from my side. Security isn't absolute; it's about making attacks not worth the effort.

Great work.

There's a trap here, let me mention it. Don't rely on a single measure; go layer by layer.

My perspective changed after experiencing that. Your time to detect an issue directly determines its cost.

Mistakes made on the what is a pentest penetration test side are usually reversible but expensive.

I'd say don't rush. When making decisions, write down the worst-case scenario too, not just the best.

Correct me if I'm wrong.

You're right, I've been down that road too. Don't hesitate to ask; those who don't ask always pay more.

This is exactly what we experienced. Mistakes made on the what is a pentest penetration test side are usually reversible but expensive.

Security isn't absolute; it's about making attacks not worth the effort.

i feel the same way. if you don't write this down from the start it leads to arguments later.

of course, it varies if your situation is different.

I'd appreciate it if you shared the outcome. If 2FA is on, a stolen password alone is useless.

exactly, and not many people know this. just because everyone does it doesn't mean it's right.