Clients want a network penetration test report, what exactly gets checked in our infrastructure during this?

Did the info-sec questionnaire from your clients specifically ask for an "external network" or an "internal network" test? Enterprises often just send out generic boilerplate forms. If the API endpoints and web services handling client data are strictly hosted in the cloud, you can cut costs by excluding the office LAN from scope.

Key things they'll check: exposed SSH and RDP ports, VPN cipher suites, DNS zone transfer issues, and outdated web server software. Testers don't take systems down; if they find a flaw, they capture proof via screenshots before attempting privilege escalation or data extraction, and stop there.

Ran into the exact same requirement last year, paid 180,000 RUB for our Moscow-based 4-server environment. Testing took 4 business days, report took 3 days. They found 2 medium-severity auth flaws and an outdated library. We patched them, had them re-test, and the client approved the report without friction.

Watch out for shops quoting 50,000 to 70,000 RUB. Most of them just run an automated scanner and hand over the raw PDF output as their "report." Security auditors on the enterprise side will spot that immediately and reject it.

Make sure to get these three clauses in writing before signing: 1) Testing must happen outside business hours and align with backup windows, 2) Immediate notification if a critical vuln is discovered during testing, 3) A free one-time retest within 30 days of fixing the issues.

definitely take fresh snapshot backups of all vms before the test starts. also don't push any major updates or deploy code on designated testing days, it messes up the traffic logs.

It pays to ask for the auditing firm's staff certifications. Having technical personnel with internationally recognized ethical hacking or network security credentials ensures your audit report gets fast-tracked by your enterprise client's info-sec board.

Noted, thanks.

Here's how it went for us. Payment information changes are never verified through the channel they came from.

When making a decision, first look at what data you have on hand. Proven by experience.

Timely topic.

We need to make a distinction here. Everything goes well for the first three months; problems arise in the fourth.

Of course, it varies if your situation is different.

Just a heads-up. An untested backup is not a backup.

Trying to do this alone is the most expensive way. If I were you, I'd go this route.

Could you elaborate on that? Most time waste accumulates in tasks waiting for approval.

That's all, sorry if I went on too long.

You're right. Security isn't absolute; it's about making attacks not worth the effort.

I completely agree. Your time to detect an issue directly determines its cost.

Having backups accessible on the same network and with the same identity makes them part of the target.

I'm curious too. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

Your time to detect an issue directly determines its cost. Just leaving this note, it might be useful.

I've been down this road, let me tell you. Everything goes well for the first three months; problems arise in the fourth.

Proven by experience.

I'm a small business, let me explain from my side. Just because everyone does it doesn't mean it's right.