Vulnerability assessment methods: Which is enough for a small company before their first pentest?

Automated scanners will catch SQL Injection or open ports, but they won't answer whether user A can view user B's invoice. In B2B logistics software, your biggest risk is multi-tenant privilege escalation. You can only catch that with manual testing.

What does your client's security questionnaire say word for word? Sometimes they just ask "do you run regular vulnerability scans?", while other times they explicitly demand a third-party certified "Penetrationstest nach BSI" or something similar. Don't spend a dime until you clarify the requirements.

For our team of 12, we paid 3,200 EUR for a 2-day hybrid web app test during our first audit. We patched the 2 high-severity findings within a week, got a re-test report, and the client signed off. 9,000 EUR is definitely overkill to start with.

Narrow the scope down. Don't give the agency your entire cloud infrastructure, just the web app where client data passes through and your API endpoints. Once you trim the scope, the required man-days and quote will drop by half.

paying 2,500 eur just to get an automated scan output is throwing money away. they just pretty up a two-page report from an open-source tool any enterprise auditor will see right through it and reject it on the spot.

Don't listen to agencies claiming an architectural review is "mandatory." Of course they want to sell you their most expensive tier. A full architecture audit on a 10-person company's codebase takes weeks and completely derails product development.

Make sure to confirm whether the quote includes a re-test. Once you fix the critical issues found in the report, the testing firm needs to issue a final executive summary confirming that those vulnerabilities were resolved.

Let me summarize the topic, since several different answers were given. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Proven by experience.

Don't miss this: If permission and scope aren't in writing, don't start that test.

This is my opinion, I'm not claiming it's absolute truth.

There's a trap here, let me mention it. The harder it is to reverse a decision, the slower you should make it.

Taking notes for two weeks yields better results than a six-month estimate. Hope this helps.

Let me summarize the topic, since several different answers were given. An untested backup is not a backup.

Same here. Start with a small trial; don't commit to everything at once.

Hasty decisions become decisions you have to fix six months later. Of course, it varies if your situation is different.

Saved. If you don't write this down from the start, it leads to arguments later.

That's all, sorry if I went on too long.

Saved.

my question might sound amateurish, sorrry about that and i mean if you get three different answers on a topic the question was asked wrong.

im also curious if anyone does it differently.

There is something to watch out for. An untested backup is not a backup.

If you have questions, write them; I'll answer as best I can.

I went through the same thing.

Thanks a lot, I'll try it today.