They keep talking about penetration testing techniques — which ones should actually be in our proposal?

Ask your client for their written audit requirements or checklist. Most corporate clients only care about a report covering external-facing assets. Unless social engineering is explicitly stated in the specs, just scope external network and web portal testing and approve the quote that way.

Went through the exact same thing last year for our 40-person manufacturing business. We stripped out social engineering and had the initial 75,000 TL quote revised down to 40,000 TL for just external network and portal testing. The auditor accepted the report with zero issues.

Ask the firm whether their web application testing includes manual verification based on OWASP standards. If they're just going to run an automated scanner and dump screenshots into a PDF, that report has zero technical value, and the auditor might reject it for lack of detail.

Is your customer tracking portal hosted on a physical server in your office or on an external cloud provider? Does the portal store personal data or commercial invoices? Those details directly dictate the depth of the external test and the techniques needed.

The social engineering line item is usually tacked on just to inflate the budget. No need to pay extra just to have them phish three employees and write a report saying "staff clicked the link"—that's staff training, not pentesting.

Tell the pricey vendor to give you an itemized quote just for the external network and web app testing. Once you get a line-by-line breakdown you'll clearly see the unnecessary costs and can trim things down according to your budget.

we also went for the whole package at first but then we ended up having to host security experts in our office for two days for the internal network test then unless it's mandatory, don't bother going that deep and disrupting your workflow; just proving your front door is locked is enough.

The takeaway from this discussion is clear: unless the client specifically asked for internal network or staff testing, having just web portal and external network techniques in your proposal is plenty. Confirm the specs before setting aside budget for extra techniques.

I agree, and I'd like to emphasize that. Your time to detect an issue directly determines its cost.

Proven by experience.

Let me summarize what's been said so far. Having backups accessible on the same network and with the same identity makes them part of the target.

saved.

I felt relieved reading this answer, so it's not just me. An automated scan report is not the same as a penetration test.

If I were you, I'd go this route.

My questions are cleared up, thanks. Don't hesitate to ask; those who don't ask always pay more.

Following.

Thanks, that was the answer I was looking for. Don't hesitate to ask; those who don't ask always pay more.

Don't hesitate to ask; those who don't ask always pay more. Hope this helps.

You're right. Most incidents start with a leaked password, not a vulnerability.

Everything goes well for the first three months; problems arise in the fourth.

I agree, and I'd like to emphasize that. Security isn't absolute; it's about making attacks not worth the effort.

I'll try it.