Finding the best penetration testing vendor for your project
In today’s day and age businesses are becoming more familiar with the term “penetration testing” and in general most IT managers, CIOs and C-Level executives have a good understanding of the pen-testing concept. However, it is still common for companies to confuse security assessments with penetration testing (Penetration vs Vulnerability Article Here ). If at the end of the day an organization has defined that their main objective is to evaluate the security of a computer system, network, app etc and clearly understands that the goal of a penetration test is to simulate a real world attack (exploit potential vulnerabilities in your organization’s systems), then the next step is to begin vendor selection. Basically, it’s now time to evaluate penetration testing companies, budget and how best to move forward with the right company or individual who specializes in ethical hacking.
So why would a company want someone to simulate an attack on their systems?
There are many do-it-your-self applications available and having the capability to run your own penetration tests can be good idea to run self-vulnerability tests whenever you make changes to your network…but a company that wants to know if their data is truly safe (client data, financial data, medical data and systems) and protected from real world hackers should seek out professional help. One of the most powerful strategies a company can deploy is 3rd party penetration testing.
The news is riddled with big name companies getting attacked and exposing customer data to hackers. According to eSecurity Planet‘s 2019 State of IT Security survey, 64 percent of organizations conduct pen tests at least annually, so as many as 36 percent of organizations are taking unnecessary risks by ignoring best practice security measures.
Even if your internal IT team has penetration testing experience and you have some in-house pen-testing tools, experts believe that a third party performing controlled penetration testing is more likely to uncover cracks that hackers will also discover, if they (hackers) haven’t already found them.
Penetration Testing – Scoping
Since scoping/project details will vary based on customer expectations, i.e., number of IP addresses, systems and other factors, it is virtually impossible to provide an out of the box “one size fits all” pricing quotation. A solid pen-testing company will want to know at the very least -preliminary information and customer requirements in order to provide the most accurate quote/timeline and expectations. Be wary of a “one price fits all” pen-test as these low price solutions that fit any scenario are most likely using an automated scan and just checking off boxes.
Initial Vendor Outreach
- Be prepared to discuss project details and answer penetration testing questionnaires. A penetration testing company with experience will ask the right questions, honing into your project and the questionnaire itself should be almost painless. If your company requires a NDA, most pen-testing companies understand that project details are sensitive in nature and will (should) provide a mutual NDA.
- Don’t expect to find the best Penetration Testing company for your project via email only. You will need to schedule an introductory call. During the intro call you should discuss initial project scoping, find out if the pen-testing engineers are senior or junior level and also discuss pen-testing strategies and procedures. Typical discovery calls are about 30 mins.
- Don’t expect a quality penetration testing company to turn around a pricing quote immediately just because you sent a brief summary and asked for a quote. An expert penetration testing company will want to know specific scoping details so that the pen-test will be aligned with your project goals, and until they know those details, its doubtful you will receive an accurate, competitive pricing quotation.
- Ask for samples of Previous redacted penetration reports. Most penetration testing companies will share reports provided you have a Mutual NDA in place
- Ask for certifications of lead engineer.
Statement of Work / Scoping Outline
A solid penetration testing scoping document will contain details on tests to be conducted along with an overview of objectives. The statement of work also contains pricing/ retest information and time expectations. It is recommended that you discuss budget and limitations prior to receiving the SOW.
Prior to receiving the SOW draft expect that the penetration testing company will want to schedule a SOW review call. Once you receive the SOW, Don’t shop it around to other companies. Its a small industry and improper to share details with other companies. It’s OK to get a few quotes to compare and is recommended, however confidential information is confidential.
Penetration Test – Kickoff
Once you have accepted Statement of Work, a quality penetration testing company will issue a Rules of Engagement Letter (RoE). Within this document all scoping details will be outlined and details will be presented so that both company and vendor expectations are aligned. Scheduling timeline will take place and service will begin as scheduled. A pen-testing project manager should be assigned and to your project and this person will be the relay between the pen-testing engineering team and your company.
Your company should be fully aware of the process once service begins. The penetration company you selected should alert you of critical vulnerabilities immediately when found, and in addition should keep you posted during each step of testing phase.
For a complete overview of penetration testing process please view: Redbot Security Penetration Testing Process
Contact Redbot Security Here
View Cost and Service Comparison List of Top Penetration Testing Companies Here