Someone is trying to sell us "pentest services" — what is this, and is it really necessary at our scale?

Don't fall for the salespeople's scare tactics right away. A pentest is definitely a useful audit, but vendors who use the "buy now or you'll go under" rhetoric rarely deliver quality work. Determine what you actually need first; don't blindly buy into their bundled package.

You need to understand the difference between an automated vulnerability scan and a penetration test. Automated tools look for known CVEs, but they miss business logic flaws. For instance, tampering with an order ID from 105 to 106 to view someone else's invoice is something only a manual tester will catch.

We paid 40,000 TL last year for a similarly scoped ordering panel. The test uncovered 2 critical authorization vulnerabilities. Our developer patched them in two days. If we'd been caught with those holes, competing dealers could have downloaded each other's custom price lists—totally worth the money.

we got a similar email pitch and passed, had our dev run basic scans with open-source tools instead. does the trick for now, but having a pro do it is obviously a different league if you have the budget.

Check the references of the company asking for 60.000 TL. Many agencies just run free tools downloaded off the internet for two hours and hand you an 80-page generic report. If the report doesn't contain a concrete analysis of your site's code or business workflows, your money is down the drain.

When evaluating the quote, make sure to clarify these three points: 1) Will it be done using a grey-box approach, meaning will test user accounts be provided? 2) Is there any risk of site downtime during the test? 3) Does the resulting report qualify as an independent audit document recognized under the Turkish Commercial Code or KVKK processes?

Don't sign a contract right away. Request scoping meetings from at least two other cybersecurity firms. Ask for a quote limited strictly to the B2B portal by providing two dealer test accounts, and keep the server infrastructure separate.

Can I ask something, does our ordering system go down for a while during this test or can dealers keep placing orders in the background?

I went through the same thing. Taking measures without an inventory leaves doors you haven't seen open.

If you post the result here, it will help others too.

We've heard this a lot, but it never happened like that for us. Processes without records never improve, because you don't know what to fix.

If you post the result here, it will help others too.

If I understood correctly, you're saying: Taking notes for two weeks yields better results than a six-month estimate.

If you post the result here, it will help others too.

The most overlooked point about what is pentest service is this: The real issue isn't the number, but what it's based on.

If you have questions, write them; I'll answer as best I can.

Could you elaborate on that? Processes without records never improve, because you don't know what to fix.

Forgotten test environments are more often the entry point than live systems. If I were you, I'd go this route.

Thanks for writing this thats the right way. Payment information changes are never verified through the channel they came from.

We experienced almost the exact same thing last year. Just because everyone does it doesn't mean it's right.

Hope this helps.

Just a heads-up. When we decide without measuring, we always end up in the same place.

If I were you, I'd go this route.

Following.

My question might sound amateurish, sorry about that. Taking notes for two weeks yields better results than a six-month estimate.

When you try to change everything at once nothing settles.