Vulnerability scan is listed in the proposal but I don't get it: what is it, is it enough, or is a pentest mandatory?

Think of a scan like this: a security guard walking around the building checking from the outside whether every door and window is locked is a vulnerability scan. A pentest is them slipping through an unlocked window and trying to crack the safe on the desk. The scan in that quote will likely just check your ports and services against an off-the-shelf database.

We paid 1,100 EUR last year to start vulnerability scanning on our wholesale distribution site in Rome. The first report flagged 34 vulnerabilities, 6 of which were critical and stemmed from an outdated server plugin. We ran the updates, and by the next quarter, our critical vulnerability count dropped to zero. It was totally worth it for us.

Before accepting the proposal, ask the firm: "Will you just dump a raw PDF on me after the scan, or does this include an hour of consulting where we sit down with our IT person to prioritize what needs patching?" If they're just going to throw an automated report over the fence and bounce, don't give them that money.

Automated vulnerability scans generate a ton of false alarms. They can make even a harmless, minor header misconfiguration look like a high-risk emergency. If you don't have someone on your team who can read that report and sort out what's real from what's noise, you'll be left holding a useless document.

tbh if u dont store card details on the portal a pentest is an unnecessary expense for now... anyway doiing regular scans and keeping up with server updates saves like 90% of small companies anyway.

Under Italian and European Union data protection regulations, you are legally obligated to implement technical measures to safeguard customer commercial data. Conducting regular vulnerability scans and archiving the reports establishes a valid, formal basis proving your proactive security efforts in the event of a data audit.

Do the technical drawings hosted on your portal belong to you, or are they proprietary designs belonging to your clients? If you are storing proprietary designs that constitute trade secrets of your clients, one of those clients might contractually require an annual penetration test; have you reviewed your contracts?

No need to overcomplicate things, just go with the 1,200 EUR package to keep your budget in check but make sure patching the flagged issues is clearly agreed on with the same team. Let them tidy up the system the first year, and if business picks up next year you can look into a pentest.

This thread is archived.

same here.

We experienced almost the exact same thing last year. If permission and scope aren't in writing, don't start that test.

If you post the result here, it will help others too.

Do you think this works at any scale? Everyone rushing into what is a vulnerability scan gets stuck at the same point.

If you have questions, write them; I'll answer as best I can.

Correct.

Three different views emerged they all complement each other. Don't rely on a single measure; go layer by layer.

If you get three different answers on a topic, the question was asked wrong.

Let me share what happened to me; it might be useful. The biggest time-waster for us was not knowing who had the final say.

If you post the result here, it will help others too.

I disagree with you on this point. The harder it is to reverse a decision, the slower you should make it.

Good luck with that.

It's rare to find an explanation this clear.

sorry but this doesn't apply in every case.. and anyway mistakes made on the what is a vulnerabilty scan side are usually reversible but expensive.

this is my opinion I'm not claiming it's absolute truth.