Asked for a pentest for a public tender: what is it exactly and when is it worth it?

Check the test methodology specified in the RFP. Black-box testing is done with zero prior knowledge of the system, while grey-box provides user credentials to audit interface and authorization vulnerabilities. Municipalities almost always ask for grey-box.

We paid 5,200 EUR for an audit on a similar project in Madrid last year. They uncovered two critical privilege escalation bugs in our own code; an outside user could access documents belonging to everyone else. We won the contract, but more importantly, we dodged a massive data leak scandal.

There are shops out there charging 1,500 EUR just to run an open-source automated vulnerability scanner and dress up the report with AI. Public agencies immediately discard superficial reports during technical review, so you'd just be throwing money away.

Define your scope carefully when requesting quotes. Ask for pricing strictly covering the specific module and host server required by the tender. If you throw your entire corporate infrastructure into the mix, costs will balloon and burn through your budget needlessly.

The engagement usually follows three phases: 1) Scoping and contracting. 2) Attack simulation and vulnerability reporting. 3) A re-test after you remediate the issues. Agencies will want to see that vulnerabilities were actually resolved in the final sign-off report.

unfortunately, this has become standard procedure if you're gonna do business with the public sector. i'd say don't look at it as a one-time expense but rather as part of the product's quality control costs.

When they run this test do they work in a staging environment or attack the live server? Is there any risk of the system crashing or customer data getting corrupted during testing?

I totally understand that the budget seems high at first. But when selling software to the public sector neutral security certifications like this give you immense leverage at the table, just as much as customer references do—dont hesitate.

I think it's hard to be that definitive about what is a pentest. Most time waste accumulates in tasks waiting for approval.

If permission and scope aren't in writing, don't start that test.

This thread is archived.

How did you solve this? Forgotten test environments are more often the entry point than live systems.

The biggest time-waster for us was not knowing who had the final say.

Great work. Most time waste accumulates in tasks waiting for approval.

The harder it is to reverse a decision, the slower you should make it. Just leaving this note, it might be useful.

My perspective changed after experiencing that. Most time waste accumulates in tasks waiting for approval.

Good luck with that.

Correct.

I'm in the same situation, that's why I'm asking. If it's your first time, start small; scaling comes later.

If you post the result here, it will help others too.

i feel the same way... like any unwritten clause becomes a point of disagreement later as both sides remember it differently.

if permission and scope arent in wriiting dont start that test. just leaving this note, it might be useful.

The opposite happened to me, that's why I'm writing. If you get three different answers on a topic the question was asked wrong.

The harder it is to reverse a decision the slower you should make it. like proven by experience.

Timely topic.