We were told we need to get a penetration test done. What is it, and is it really necessary?

A vulnerability scan looks at your system and tells you the door lock is an older model. A penetration test actually picks that lock, walks inside, attempts to crack the safe, and includes fake data extracted from inside the report as proof. Your client is asking for that verified proof.

What does your client's contract say word for word? Sometimes they ask for a grey-box penetration test, other times an external network test is plenty. Don't start collecting quotes before clarifying the test type, or you'll end up paying for out-of-scope services for no reason.

We got hit with a similar request last year. We hired an independent specialist in Turin just for the external API and the client login portal. They billed 3,200 EUR for 3 days of work, and the client accepted the report right away.

There are plenty of consultants out there selling automated scanner outputs as a 40-page PDF under the name of a penetration test. When getting quotes, make sure to ask for a sample report and their manual testing methodology so you don't throw money at a useless report.

Don't sign any proposal right away. Sit down with your sysadmin first and draft a scoping document: How many static pages, dynamic forms, and API endpoints need testing? Send that list to three different firms and watch the price drop.

From a legal standpoint, it is critical to execute a comprehensive non-disclosure agreement with the testing party and formally agree in writing to testing hours that will not disrupt your daily operations.

we thought it was a total waste of money at first too, but the report revealed unauthorized access to the accounting panel. it stings the budget yeah but it beats losing a client or having your data stolen.

My questions are cleared up, thanks.

Absolutely. If I were to add anything: Don't rely on a single measure; go layer by layer.

Just because everyone does it doesn't mean it's right. If you post the result here, it will help others too.

Noted, thanks.

You're right. If it's your first time, start small; scaling comes later.

An automated scan report is not the same as a penetration test. If you have questions, write them; I'll answer as best I can.

Good call starting this thread.

Following. Processes without records never improve, because you don't know what to fix.

Hope this helps.

Timely topic.

Great work.

Let's separate the concepts, they're getting mixed up. The real issue isn't the number but what it's based on.

Hope this helps.

this approach has a cost which isn't discussed and honesty when making a decision first look at what data you have on hand.

i'm also curious if anyone does it differently.

There's a trap here, let me mention it. Start with a small trial; don't commit to everything at once.

If 2FA is on a stolen password alone is useless. Good luck with that.