I have been engaging a client for two months now. They are a major electricity generation and distribution company.

For each project, I have got more than enough time to finish my SoapUI test cases so I am thinking to offer free security testings to my client.

But a second thought is telling me I should not be doing this as I could have charged them for doing it.

Should I add value to my engagement by doing free security testing?

  • 1
    Attempt to negotiate a fair price for security testing. If the client isn't willing to pay anything, then your "value added" is zero. Mar 19, 2017 at 19:17

2 Answers 2


Should I add value to my engagement by doing free security testing?

No, you should not and the reason is not about money.

  • Security testings need to always involve your clients' consents, which means before security testing is carried out, your clients need to be aware of it and explicitly give you a "green light"; this "green light" needs to be a tangible proof as well, e.g. a written consent.
  • The reason for this is: security testing is a very different animal comparing to other non-security testing. Security testing is treated very seriously as confidential information could be leaked, damaged or destroyed, critical processes could be paused or stopped, by executing a security test without informing your manager AND your client manager will be a very bad idea.

I have seen a real life example last year:

One contract tester did an unauthorized password attack on his client's database; his original intention might have been good but the result was his client's database automatically locked down, rendering it inaccessible. That company's business was dependent on accessing its database in real time. The whole business operation suddenly stopped for 2 hours for no apparent reasons. This was a very very bad.

Please do not execute any security tests without telling your manager AND your client's manager AND get your client's provable consent.

  • 1
    Your answer is implying quoting from OP, but those are your own words "I have seen a real life example last year." and the rest. Change formatting if your like it formatted differently. Mar 20, 2017 at 13:51
  • @PeterMasiar, ok, thanks for that. I will keep it in mind from now one
    – Yu Zhang
    Mar 20, 2017 at 16:57
  • why would you execute said practices on a live/production database instance, no good can come of it.
    – symon
    Apr 5, 2017 at 14:16

Security testing is a very critical task and should not be performed without the consent of client as it will impact the clients environment. As security testing services, we need to analyze the type of testing that needs to be performed on the environment i.e. Vulnerability, Penetration etc. Moreover, this should be done by specialized security testing expert team within organizations and should be calculated on the basis of man hours.

  • Not sure what this adds to the (already) accepted answer, or to the (almost) five year old question... but I do wonder why you think the cost of security testing should be calculated on man hours though?
    – dvniel
    Dec 10, 2021 at 11:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.