How does the penetration testing process work, and what do we need to prepare internally beforehand?

If this is meant for enterprise client procurement, explicitly request a gray-box web application pen test. Black-box testing simulates an outside attacker with zero access, but it completely misses broken object-level authorization and privilege escalation flaws deep inside your application logic. Always provision at least two accounts with different user roles for the pen-test team.

Create a spreadsheet right now listing every public-facing server IP, your web app login URL and the count of underlying backend microservices. Hand that exact asset list over when you request quotes; firms will immediately understand the scope and you'll have pricing back within three days.

Don't skip these four operational steps during prep: 1) Take full image/snapshot backups of your production instances. 2) Whitelist the testing team's public source IPs on your WAF and firewalls. 3) Rate-limit or mock out transactional email and SMS dispatchers in your staging environment. 4) Notify your cloud hosting provider of the testing schedule in advance.

if u run this against production watch your database like a hawk but while testers fuzz innput fields with payloads, your system can accidentally blast out hundreds of dummy invoices or automated SMS notifications to real users. temporarily disable downstream notification microservices during the scan windows.

Does your corporate client only want your web app tested, or did they also require internal local network and employee phishing tests? If the scope is just your SaaS app, a 70.000 TL budget will be more than enough.

Last month we had a test done for a similar retail integration covering 1 web app and 6 external IPs. It took 5 days, and the draft report showed 2 critical and 4 medium vulnerabilities. Patching the flaws and finishing the retest took us 20 days in total.

There are firms out there that just run an automated vulnerability scanner, spit out a generic 100-page PDF, and call it a pentest. When getting quotes, make sure to get a written commitment that manual verification is performed and business logic flaws are checked.

In short, take an inventory of your IPs and URLs, agree on a gray-box methodology, set up a staging environment, back everything up, and definitely confirm that retesting is included in the price. The whole process usually wraps up within a month.

I was thinking the same thing. If you get three different answers on a topic, the question was asked wrong.

I'm also curious if anyone does it differently.

Let me clarify the technical side. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

Good luck with that.

Generally correct, but one part is missing. Mistakes made on the how penetration testing is conducted side are usually reversible but expensive.

Most time waste accumulates in tasks waiting for approval. Proven by experience.

Noted, thanks.

Saved.

We experienced almost the exact same thing last year. Don't hesitate to ask; those who don't ask always pay more.

Just leaving this note, it might be useful.

Don't miss this: An untested backup is not a backup.

That's all, sorry if I went on too long.

I've been dealing with this for a long time. The biggest time-waster for us was not knowing who had the final say.

The most overlooked point about how penetration testing is conducted is this: Most time waste accumulates in tasks waiting for approval.

Of course, it varies if your situation is different.

Absolutely. If I were to add anything: Your time to detect an issue directly determines its cost.

Processes without records never improve, because you don't know what to fix.