We were asked to get a pentest for our site, what does that mean and is it really necessary?

Pentests are usually done using three methods: Black Box, where zero info about the system is provided; White Box, where source code and server access are granted; and Gray Box, done using standard user privileges. For an e-commerce site, the most efficient one is a Gray Box test, which mimics both an external attacker and a customer with escalated privileges.

We had a 3-day test done for our similarly sized site two months ago and paid 38,000 TL. We weren't storing cards either, but an authentication vulnerability was found on the API. Turns out any user could view the order history and home addresses of all other customers. Patching just that one vulnerability was well worth the money.

Definitely ask the firm quoting 45,000 TL about their scope. There are plenty of shops out there that just run automated software and hand over the tool's raw output two hours later calling it a report. Will they do manual testing, how many man-days will they put in does the tester have valid certs? Get all of that in writing.

If your partner wants the report, you can't dodge it. To bring the quote down, narrow the scope: 1) Include only the web app and exclude the internal office network, 2) Cap the testing duration at 2 business days, 3) Put a free verification test (re-test) in the contract for after the vulnerabilities get patched.

Last year when we were running a small jewelry site, we used to say "who would bother targeting us." Then one day they breached our database through the customer portal, wiped all delivery addresses, and demanded ransom. We couldn't make sales for two weeks, and restoring backups plus recovering from data loss cost us way more than any test fee ever would.

using a third-party virtual pos only covers card security. anyway if the address and contact details of thousands of people stored in your site's database get stolen, the penalties under kvkk will be way higher than 45k lira.

Does your partner want a standard independent audit report, or are they requiring a TSE-approved Level A or B certified penetration test? If their spec sheet mentions a specific accreditation requirement, don't waste money on shady fly-by-night firms—the report won't be accepted.

Don't let the process freak you out just because it's your first time. Your site won't crash while the security firm is testing; they usually run tests on a staging clone or during low-traffic overnight hours in a controlled way.

The opposite happened to me that's why I'm writing. Don't rely on a single measure; go layer by layer.

This is my opinion I'm not claiming it's absolute truth.

You're right.

let me share what happened to me; it might be useful but your time to detect an issue directly determines its cost.

of course it varies if your situation is different.

I'm curious too. Don't hesitate to ask; those who don't ask always pay more.

An automated scan report is not the same as a penetration test. Proven by experience.

Thanks, that was the answer I was looking for.

Same here.

Generally correct, but one part is missing. Just because everyone does it doesn't mean it's right.

If I were you, I'd go this route.

id say dont rush. taking notes for two weeks yields better results than a six-month estimate.

this is my opinion, I'm not claiming it's absolute truth.

The opposite happened to me, that's why I'm writing. Solutions that work at a small scale collapse when you grow; I learned this late.

Proven by experience.

I didn't know that.