We're an SME: is penetration testing legally mandatory for us or purely voluntary?

When an enterprise deal is on the table regulations don't really matter—you won't close the contract or win the RFP without that report. When getting quotes, ask firms to scope only external IPs and the web application. Leaving the internal network out for now should drop that 65,000 TL quote down to around 35,000-40,000 TL.

We went through a similar process last year with our 30-person team. We had no choice but to pay 50.000 TL and get it done because of a client specification. During the test, we found out our database port was publicly exposed without authorization and an old API endpoint was running without any authentication. At first we thought it was a useless expense, but the reputational damage those vulnerabilities would have caused would've cost way more than that money.

The market is flooded with hundreds of middlemen who just run an automated scanner for 15.000 TL and dump an 80-page report on your desk. If your enterprise client's info-sec team knows anything at all, they'll trash that report immediately and your money will go down the drain. Make sure the service you get definitely includes manual verification and scenario-based exploitation.

You can evaluate this across four main points: 1) There is no legal obligation unless there is a direct sectoral mandate. 2) Because it is considered a technical measure under KVKK, not having done a test counts as negligence in the event of a data breach. 3) Enterprise clients with ISO 27001 can include it as a contractual requirement. 4) If you ever want to get cyber liability insurance, it will show up as a policy prerequisite.

btw don't send the whole report to the client when it's done. ask the security firm for an executive summary. handing the clieent the full technical breakdown with all the vulnerabilities and exploit steps creates other security risks.

During vendor audit processes, you are subject to the other party's risk matrix. Signing an NDA prior to the contract and requesting a scope verification document stating that the audit findings will remain strictly limited to the agreed scope will protect your rights.

Did your client mandate TSE standards or a specific certification for the report? If an independent third-party report is enough on its own, you could keep the scope limited to the web panel and cut down costs; have you read the specifications carefully?

Everyone thinks it's a completely pointless expense at first but it's a hurdle every growing B2B software dev has to clear. tbh once you do it once and get the hang of the methodology it goes way faster and with a lot less stress in the following years, don't let it intimidate you.

This is exactly what we experienced. Most time waste accumulates in tasks waiting for approval.

Of course, it varies if your situation is different.

There's also a measurement aspect to this. Solutions that work at a small scale collapse when you grow; I learned this late.

Timely topic. If you don't write this down from the start, it leads to arguments later.

If you post the result here, it will help others too.

saved. tbh taking notes for two weeks yields better results than a six-month estimate.

if you have questions, write them; I'll answer as best I can.

Exactly like that. Solutions that work at a small scale collapse when you grow; I learned this late.

I'm also curious if anyone does it differently.

I felt relieved reading this answer so it's not just me. Mistakes made on the is pen testing mandatory for smes side are usually reversible but expensive.

My perspective changed after experiencing that. When making decisions, write down the worst-case scenario too, not just the best.

That's all, sorry if I went on too long.

There are three things to check when doing this. If you get three different answers on a topic, the question was asked wrong.

If you have questions, write them; I'll answer as best I can.

I'm curious too.

If I understood correctly, you're saying: Your time to detect an issue directly determines its cost.

Correct me if I'm wrong.