We got a quote for a fixed-price standard penetration test; how does it differ from a comprehensive one?

The biggest danger with standard packages is missing Broken Object Level Authorization (BOLA) flaws entirely. Automated scanners blindly fire payloads at HTTP parameters, but they won't know how to query Company A's waybill using Company B's auth token in a logistics dashboard. Those checks require manual testing.

Put these three questions in writing to both vendors: 1) How many hours of manual exploitation are included? 2) Are API endpoints and mobile interfaces fully in scope? 3) Do you provide a complimentary re-test once we patch the findings? Their answers will immediately justify the price difference.

We went with a 14,000 SAR standard test for a similar deal in Jeddah last year. Out of the 18-page report, 15 pages were generic boilerplate and automated tool exports. The client's security team rejected it on the spot, and we ended up spending another 32,000 SAR to get a proper scoped test done anyway.

didn't you ask the cheaper company for thheir scope list? they'll probably just punch in an IP range run an automated tool and hand over a PDF report three days later then if your client's security manager knows their stuff at all, that report will get rejected immediately.

standard ones are basically just point-and-click button tests tbh... if they didnt ask for source code or api docs, theyre just gonna run an automated scan and call it a day, no way a manual test gets done in three days.

Send the scoping document to the other party's information security manager beforehand. Do not make any payments to any firm without getting written confirmation on which test methodology they will accept.

How is the penetration test scope defined in your NDA and service agreement with the client? Are they asking for black box or white box? Also, does your system process payments or store sensitive customer data?

With our first B2B client, we cut corners and bought an off-the-shelf packaged test, then celebrated when the system came back clean. Two months later, the client's accountant realized that simply tweaking a URL parameter let them download a competing firm's shipping invoices. That was the day we learned standard testing is just an illusion.

I'd appreciate it if you shared the outcome. Don't hesitate to ask; those who don't ask always pay more.

Processes without records never improve, because you don't know what to fix. If I were you, I'd go this route.

I have a question, don't want to go off-topic though. When making a decision, first look at what data you have on hand.

The answer varies greatly by industry; there is no one-size-fits-all rule. Hope this helps.

i agree.

Good call starting this thread.

There are three things to check when doing this. When you try to change everything at once, nothing settles.

Just leaving this note, it might be useful.

Correct. btw start with a small trial; don't commit to everything at once.

Good luck with that.

I went through the same thing two years ago. An untested backup is not a backup.

The real issue isn't the number, but what it's based on.

I have a question. btw taking notes for two weeks yields better results than a six-month estimate.

Just leaving this note, it might be useful.

Following.

Could you elaborate on that? If 2FA is on, a stolen password alone is useless.

If you have questions, write them; I'll answer as best I can.