They brought up "penetration testing" — is it really necessary for our scale, what does it actually do?

Doruk Ş***16 days ago·35 messages·5.4K views#penetration test #information security #cybersecurity #website

Doruk Ş***MemberCommunity member

Joined: Oct 2024
Message: 218

16 days ago#1

We are a wholesale spare parts business with 14 employees based in Bursa. About six months ago, we had a custom B2B dealer portal built where our clients can place orders, view their account balances, and check invoices. The agency that built the system reached out last week, saying that as part of annual maintenance, we need to have a penetration test performed, quoting an extra budget of 45.000 TL for it.

Frankly, I am not very technical. We already have a firewall and an SSL certificate on the server, and daily backups are taken. I briefly looked it up online, but the concepts seemed overwhelming. I can't tell whether this work proposed by the agency is genuinely a necessary security measure or just a standard upsell package targeted at small businesses.

What exactly does a penetration test cover, and for a portal serving a limited number of corporate clients like ours, is it worth incurring this cost?

BerenMember

Job title: Product designer
Joined: Mar 2024
Message: 112

16 days agoMost Helpful#2

Short answer: A penetration test is a controlled cyberattack simulation where a qualified security professional acts as an authorized attacker to detect vulnerabilities in your system before malicious actors do. An SSL certificate or firewall only locks the front door; a penetration test checks whether the windows, ventilation vents, and back doors are locked by actively trying to breach them.

You can determine whether a penetration test is necessary for a B2B portal at your scale by looking at three criteria: 1) What data resides on the portal, 2) Whether the software is custom-built or a ready-made platform, 3) The legal and commercial risk a data breach would pose to you. If your dealers' statement transactions, tax numbers, account balances, and order histories are stored on the portal, an unauthorized party breaching another dealer's dashboard leads to severe administrative penalties under KVKK.

If the software was custom-coded from scratch, the likelihood of authorization flaws caused by developer oversights is quite high. In current market terms, 45.000 TL is a standard figure for a small-scope web application test; however, before paying that, you need to clarify the scope of the test. It is essential that the test does not merely consist of running an automated scanner and generating a report, but also includes manual business logic testing.

Efe A***Member

Job title: IT manager
Sector: Livestock
Organization type: early-stage startup
Joined: Apr 2024
Message: 2

16 days ago#3

It makes no sense for the agency to run a penetration test on code they wrote themselves. You can't expect them to find and report their own mistakes. Even if you decide to go ahead with this test, get a quote from an independent firm that specializes exclusively in cybersecurity rather than the agency that developed the portal.

Veli Ç***New member

Job title: Call center representative
Sector: Machinery manufacturing
Organization type: cooperative
Joined: Jun 2026
Message: 387

15 days ago#4

Penetration testing specifically checks for Broken Object Level Authorization, meaning unauthorized data access flaws. For instance, when dealer A logs in and changes the invoice number in the browser URL from 101 to 102, can they see dealer B's invoice? A firewall won't catch that; only a penetration test will.

KorhanExpert

Job title: B2B Sales Manager
Joined: Sep 2023
Message: 162

15 days ago#5

Last year, we paid 35.000 TL to an independent expert to test our portal serving 20 dealers, similar in scale to yours. The resulting report revealed that two dealers could see each other's discount rates. If that leak had gotten out in the market, our commercial reputation would have been ruined. It was totally worth the money.

Taner E***Member

Job title: Purchasing manager
Sector: Leather
Organization type: early-stage startup
Joined: Jun 2023
Message: 132

15 days ago#6

the agency will probably just run an automated tool and hand you a pdf export. like ask for a scope document check if it specifies how many hours of manual testing will be done imo.

edit: typed from phone, sorry for typos.

Ümit K***Member

Job title: Operations manager
Sector: Jewelry
Organization type: a company within a holding
Joined: May 2022
Message: 406

15 days ago#7

Do you process credit card payments through the portal? If card details are stored on the system or routed through your own server instead of a hosted payment gateway, testing is an outright necessity, not a luxury.

Ömer I***MemberCommunity member

Joined: Nov 2024
Message: 1

14 days ago#8

Before accepting the quote, ask the agency this: "Will this test be grey box or black box, and is remediation retesting included in the price once the detected vulnerabilities are patched?" Without a retest, the report ends up being useless scrap paper.

Tolga Ş***Expert

Job title: Production Manager
Sector: Livestock
Organization type: workshop
Joined: May 2023
Message: 38

14 days ago#9

Two years ago hackers breached the portal of an acquaintance who runs a textile wholesale business and sold their entire customer list and pricing sheets to a competitor. Neither backups nor SSL could save them. Ever since we have made security audits routine after every major release.