Should we buy pentesting tools and run them ourselves, or is that a bad idea?

Break this into two distinct parts: 1) Vulnerability scanning is automated; it uses tools to scan for known issues. 2) Penetration testing requires human ingenuity to actively exploit a discovered flaw and verify whether sensitive data can actually be accessed. Your client wants the second one; with an automated tool, you can only deliver the first.

Careful when running automated scans yourself: these tools fire arbitrary inputs into web forms. Run it on prod and you'll dump hundreds of junk records into your DB, or burn through your entire API balance in minutes if you have automated payment or SMS integrations. Absolutely do not run it in production.

We made a similar mistake two years ago. We sent a bank client a scan report straight out of an automated tool we bought. Their security team immediately called us out, pointing out that 14 critical findings were completely false positives, while an obvious authorization flaw wasn't flagged at all. The hit to our reputation cost way more than the 4,000 GBP we thought we were saving.

Are you sure the firm quoting 5,500 GBP is actually doing manual testing? A lot of agencies just spin up the exact off-the-shelf tools you're looking at, dump the logs into a branded template, and bill you for a full pentest. Make sure you ask them about their scope, methodology, and how many hours of hands-on manual analysis are included.

Information security clauses in enterprise contracts typically mandate tests conducted by accredited, independent auditors. An internal assessment report prepared by your own staff will not limit your legal liability in the event of a breach, and it could leave you exposed to breach-of-contract damages.

Check the client's security questionnaire. If it explicitly specifies an independent third-party pentest, don't waste time trying to do it yourself. Negotiate with the agency by narrowing the scoped IP addresses and domains to get the price down toward the 4,000 GBP range.

Don't completely disregard your developer's initiative, but reposition the tool as a development-stage safety net. If you scan internally and patch basic flaws before the third-party assessment the external firm's report will come back clean giving you a much stronger deliverable to hand your client.

edit: typed from phone, sorry for typos.

saved.

I can't fully agree with this. An untested backup is not a backup.

The real issue isn't the number, but what it's based on. Hope this helps.

I didn't know that. People defend habits, not processes. Resistance comes from there.

Good luck with that.

i completely agree. processes without records never improve, because you don't know what to fix.

hope this helps.

The answer above hits the nail on the head. Start with a small trial; don't commit to everything at once.

Proven by experience.

We experienced almost the exact same thing last year. If 2FA is on, a stolen password alone is useless.

When you try to change everything at once, nothing settles. Proven by experience.

Just a heads-up. Trying to do this alone is the most expensive way.

An automated scan report is not the same as a penetration test. Of course, it varies if your situation is different.

Following.

We experienced almost the exact same thing last year. Forgotten test environments are more often the entry point than live systems.

This is my opinion I'm not claiming it's absolute truth.

I'm curious too.