Guide
How to buy a penetration test when a customer asks for one
A customer, partner or auditor has asked for a penetration test, and arranging it has landed on you. This guide takes you from that request to a booked test. It covers what to ask first, what to tell each pentest provider, how to compare the quotes and how to plan around the date.
I’ve been on both sides of this request. I’ve tested systems for 27 years, and as co-founder of an app studio I’ve also been the one filling in a customer’s security questionnaire and chasing a pentest report to attach to it. The steps below are what I’d do in your seat, and they work whichever provider you choose.
1. Find out what the requester needs
“Please send us a recent pentest report” sounds like one request and can mean several things. The note above asks for the answers that change what you buy.
Which systems. “A pentest” might mean the web app your customer logs in to, the API their systems connect to, your mobile app, or all of them. Testing the wrong one is the costly mistake, because you pay for a test and still don’t have what they asked for.
Which environment. Ask whether the test can be run against your development or staging system, or whether it has to be the live one. If they accept staging, ask your provider whether it’s close enough to the live system for the agreed scope, and tell them about any services or data the two share before testing starts. If it has to be the live system, ask whether the testing can be done during working hours, and check the same with your own team. Testing outside working hours is harder to schedule, so every provider needs to know before they quote.
What evidence they need. Some requesters want the full report. Some accept a summary, or a letter confirming the test took place. Many want proof that the serious findings were fixed. What’s in a penetration test report goes through the sections they are likely to look for.
What the deadline covers. The date might be for the first report, or for an updated report after you’ve fixed things and the provider has checked the fixes. The second can take weeks longer.
How recent. If you already have a report, ask whether it would do. “Recent” often means within the last twelve months, but the requester sets the rule, and the report has to cover the systems they named.
If they name a framework such as SOC 2 or PCI DSS, a qualification the people doing the testing must hold, or a report format, get their exact wording in writing before you book anything. Send it to each provider and ask them to confirm they meet it.
Only the person who asked for the test can say what they will accept. Whatever a provider tells you, and that includes us, confirm it with them.
One thing to settle early: if they asked for a penetration test, a scan report won’t satisfy them. Penetration test vs vulnerability scan explains the difference.
2. Give each provider the same scope
Quotes only compare if every provider priced the same job. Write the scope down once and send the same text to each of them. It needs to cover six things.
- What it is. The app or API, and what it does.
- The main things people do in it. Signing up, paying, uploading files, inviting teammates.
- User roles. Customer, manager and admin, for example. Each role is tested against the others, so roles change the size of the job more than screens do.
- Where to test. A development or staging copy, or the live system. If it’s the live system, say whether testing can happen during working hours.
- What access you can give. Test accounts for each role, API documentation, and source code if you’re willing to share it.
- The deadline. Include whether it covers a retest.
A few plain sentences are enough. Something like this:
We have a web app and an API for booking equipment rentals, with about 30 screens and 40 API endpoints. There are three roles: customer, staff and admin. We can give you a staging copy, test accounts for each role and our API documentation. Our customer needs the report by the end of next month, and an updated one after we’ve fixed what you find.
That starts a scoping conversation. A good provider will come back with questions, and rough counts are fine.
Before testing starts, sign off in writing on what the provider is authorized to touch: which systems, which accounts and on which dates. If part of it runs on someone else’s service, check whether they need to be told.
3. Compare quotes side by side
Ask every provider the same five questions and write the answers next to each other before you look at the price. Copy this table and fill it in.
| Check | What to ask | Provider 1 | Provider 2 |
|---|---|---|---|
| Scope and exclusions | Does the quote name every system from step 1? What does it leave out? | ||
| Who does the manual testing | Who will do the work, and how much of it is done by hand? | ||
| What the report contains | Can I see a sample report before I book? | ||
| Delivery | What is the earliest you can start? What day does the report arrive? | ||
| The retest | Is it included or charged for? How soon do I have to use it? Do I get an updated report? |
Two of those rows deserve a closer look. A scanner’s output with a cover page is not manual testing, and it is not what your customer asked for. And a sample report tells you more than any description of one. Our sample report shows what evidence and a recommended fix look like, so you have something to hold the others against.
Then compare prices. How much a penetration test costs has typical sizes and what moves the number.
4. Work backward from the deadline
A start date is not a report date. Begin with the day the evidence is due and count back through each stage.
- The date your requester needs the evidence.
- The retest and the updated report, if they want proof of fixes.
- The time your team needs to fix what was found.
- The report. Ours arrives within five business days of the last testing day.
- The testing days themselves.
- The wait for a start date. Ours is usually within two weeks.
With our timings, a four-day test booked today produces a first report in about four weeks. If the fixes and the retest also have to land before the deadline, add your team’s fixing time and the retest on top. How long a penetration test takes has the full timeline.
Ask each provider for their earliest start date, not their usual one. That gives you a date you can compare.
If the date is already too close, tell the requester the dates you have booked and ask whether a booking confirmation will hold things until the report arrives.
5. A worked example
This example is illustrative. The company, both quotes and every date in it are made up, and the prices are there to show the arithmetic.
Maya runs operations at a 15-person software company. A customer’s security team emails: “Please send us a recent pentest report.” The company has never had one.
She sends the note from the top of this page. The customer replies that they need the web app and the API covered, a staging copy is fine, they want the full report, and they need an updated report showing the serious findings fixed. The deadline is ten weeks away.
Maya writes four sentences of scope: the web app, the API, three roles (customer, manager and admin), a staging copy with test accounts, and the ten-week deadline including a retest. She sends the same text to two providers.
| Quote A | Quote B | |
|---|---|---|
| Price on the quote | $3,500 | $4,800 |
| Covers | Web app | Web app and API |
| API | Not included, $1,500 extra | Included |
| Retest | $900 | Included |
| Cost of what the customer asked for | $5,900 | $4,800 |
Quote A looks $1,300 lower until she checks it against the customer’s reply. It leaves out the API and charges for the retest, and the customer needs both. Quote B already covers everything she listed.
Before she books, Maya counts back from the deadline, and finds two dates she doesn’t have. The quote gives a start date in two weeks, four days of testing and a report a week after that. Her developers want three weeks to fix whatever is found. That is seven weeks. Neither quote says how long the retest or the updated report will take.
So she asks. The provider can retest within a week of hearing the fixes are in, and will send the updated report three business days later. That takes her to the end of week nine, with a week to spare. She asks for the retest week and the updated report date to be written into the booking, and then she books.
If Maya’s situation looks like yours, see web app and API testing.
If you'd like us to quote
Escaped is one of the providers you could send your scope to. We're small, so you talk to Rob Pope, who scopes every job and checks every report before it goes out. The testing is done by hand. If another tester works on your job, we'll tell you who before testing starts. Testing usually starts within two weeks and the report follows within five business days. Tell us your deadline and we'll tell you whether we can meet it before you commit to anything.
The day rate is $1,200. You get a fixed quote before work begins, and the retest is free.
Need a figure to get the budget approved? We'll send an estimate by email within one business day. Ready to talk through the scope? You'll get a fixed quote.