Should I add value to my engagement by doing free security testing?
No, you should not and the reason is not about money.
- Security testings need to always involve your clients' consents, which means before security testing is carried out, your clients need to be aware of it and explicitly give you a "green light"; this "green light" needs to be a tangible proof as well, e.g. a written consent.
- The reason for this is: security testing is a very different animal comparing to other non-security testing. Security testing is treated very seriously as confidential information could be leaked, damaged or destroyed, critical processes could be paused or stopped, by executing a security test without informing your manager AND your client manager will be a very bad idea.
I have seen a real life example last year:
One contract tester did an unauthorized password attack on his client's database; his original intention might have been good but the result was his client's database automatically locked down, rendering it inaccessible. That company's business was dependent on accessing its database in real time. The whole business operation suddenly stopped for 2 hours for no apparent reasons. This was a very very bad.
Please do not execute any security tests without telling your manager AND your client's manager AND get your client's provable consent.