A major client wants a pre-contract penetration test, how should we define the scope?

Corporate auditors spot automated scanner dumps right away. If the report doesn't start with an executive summary, a methodology reference, and remediation sign-off dates showing how vulnerabilities were resolved, the client won't accept it. Don't cheap out and risk losing the deal.

Request a written copy of the security specification document from your client. In most corporate structures, security requirements are defined via a standard checklist. Getting hold of this document and sharing it with the security firms you're sourcing quotes from will prevent out-of-scope costs.

To nail down the scope, you need to clearly provide these three parameters to the firms: 1) The number of user roles in the system (admin, vendor, standard user). 2) The number of public-facing API endpoints. 3) Whether the test will be run in production or on an exact staging replica.

We're also an 18-person team in Valencia. A similar client accepted a pentest we had done for around 4,000 Euro. The test took 4 days and turned up 2 high-severity vulnerabilities. Our team patched them in 10 days and the security firm provided a retest report for free. The client signed the contract two days later.

The ones quoting 8,500 Euro probably bundled your entire cloud architecture and internal office network into the scope. Why would you test your corporate office network where no client data is stored? Whatever the sales contract covers, the test should be strictly limited to that specific data flow.

Definitely do not run the test against your production database. Spin up a dedicated staging environment that mirrors prod identically but is filled with dummy data. Security testing can trigger DB deadlocks or unexpected drops, you don't want your live operations grinding to a halt.

stay away from firms promising to wrap it up in two days imo. they just run an automated scanner and hand you a pdf. an enterprise client will see right through that and make you redo it from scratch.

edit: I wrote something wrong above, sorry about that.

65,000 Euro annually is a fantastic contract, congrats. 3,000-4,000 Euro is a totally reasonable security investment for a deal of this size. Plus once you have that report in hand you can showcase it as a trust factor to other prospective enterprise clients down the road.

There's also a measurement aspect to this. When you try to change everything at once, nothing settles.

Good luck with that.

Exactly, and not many people know this. Forgotten test environments are more often the entry point than live systems.

The real issue isn't the number, but what it's based on.

I'm curious too.

This thread is archived.

Let's separate the concepts, they're getting mixed up. Everything goes well for the first three months; problems arise in the fourth.

Processes without records never improve, because you don't know what to fix.

great work. any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

hope this helps.

We got stuck at the same point for a while. Having backups accessible on the same network and with the same identity makes them part of the target.

Payment information changes are never verified through the channel they came from.

I have a question. If you scold false alarms, nobody will report again.

Hope this helps.

The opposite happened to me, that's why I'm writing. Trying to do this alone is the most expensive way.

Everything goes well for the first three months; problems arise in the fourth. Just leaving this note it might be useful.

Let me clarify the technical side. If you don't write this down from the start, it leads to arguments later.