0

Details:

A customer would like to know in detail what costs penetration testing causes on the one hand, and what benefits penetration has on the other hand.

Also, what it effectively means to save costs through security.

The last point cannot be narrowed down by me exactly, therefore my question in this regard:

  • Can I offset the costs of security issues against errors that occur and need to be fixed?
  • Are there any calculations here?
2
  • 1
    I think this question needs more clarity of its context. It's very difficult for us to know what benefits and costs the service you provide can bring. If all your knowledge is from reading the Security Testing wikipedia page or if it comes from 30+ years of experience in the specific context of your client, then everything will be different. Nov 2 '21 at 23:39
  • Surely it is not too unspecific to ask whether there is a calculation basis for a penetration test. Even the Wikipedia article does not agree on this. Moreover, it is not a good source on this topic. Since no one has a basis, one must either create it or try to get information like here in the example.
    – Mornon
    Nov 3 '21 at 5:49
2

I've been involved in organizing penetration testing for my employer's software, and what I've experienced is that the quoted price depends on a combination of:

  • how big/complex the software is (usually approximated by how many pages in a web application)
  • how much time the penetration testers will need to work through the software

As a general guideline, if the penetration tester(s) will be working entirely through scanning the application with one of the standard tools and interpreting the results it will be less expensive than a mix of automated and manual security testing.

It's best to think of the costs of penetration testing as insurance: depending on the country your customer is in, fines for data breaches can be extremely significant (and can cause bankruptcy). By finding and fixing security holes, security testing helps to prevent data breaches. As such, it's not so much a question of how much prevention can save as whether the business can afford to go without it.

1

The total cost might depend on several factors, such as type of penetration test, scope, length, and the number of testers.

Type

This company offers several types:

  • EXTERNAL NETWORK PENETRATION TEST
  • INTERNAL NETWORK PENETRATION TEST
  • PIVOT (ASSUMED COMPROMISE) TEST
  • WEB APPLICATION PENETRATION TEST
  • COMMAND AND CONTROL & DATA EXFILTRATION ASSESSMENT
  • RED TEAM
  • MOBILE APPLICATION ASSESSMENT
  • WIRELESS PENETRATION TEST

(I have no affiliation to the company, this is just an example)

Scope

The scope is directly proportional to cost, this is pretty obvious. More servers/locations need to be tested, more working hours to bill.

Length and number of testers

You could hire one tester for one day or multiple testers for multiple weeks/months.

Benfefit

It depends on the value of data or servers' downtime or ransom or whatever factor will hurt you the most.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.