Blog

It is important to understand what you are paying for when it comes to a penetration test. The purpose of a penetration test is to identify vulnerabilities and evaluate the overall impact of a potential attack on your business. Some of the largest data breaches have proven that it only takes one overlooked vulnerability to jeopardize a company’s assets.

When you invest in a penetration testing company, you are paying a professional security team to manually test your systems and applications. This requires looking for all potential attack vectors and exploiting them, so if a price is too good to be true, it likely is.

Below is a list of factors that affect the cost of a Penetration Test:

1. Type of Testing

The cost of a penetration test depends on the service provided. The type of testing required depends on your reason to conduct one, whether it is compliance regulations, deploying a new application, or after an incident has already taken place. The three services we offer are infrastructure penetration testing, application security testing, and objective-based penetration testing.

2. Scope

It is also important to understand your business requirements and what is actually in scope. Prices range based on the size and the degree of complexity of the systems being tested. The key components we use to determine effort allocation are the total number of IPs, how many web applications require testing, and the total number of roles and pages per application. However, the more restrictive the scope is, the less value a penetration test would have because for a potential hacker, their scope is not limited.

3. Methodology

It is vital to ensure that your penetration test is conducted consistently using globally accepted and industry standard frameworks. Our methodology is derived from the OWASP Top 10 and has been enhanced with current threats and our overall experience. We examine the following issues:

• Network Security

• OS and Third-Party Patching

• Database Security

• E-Mail Phishing

• Configuration Management

• Identity Management

• Cryptography

• Authentication & Authorization

• Input Validation

• Business logic

• Error Handling

• Session Management

• Client-side Protection

4. Automated vs Manual

Automated scanning is the process of finding and measuring the vulnerabilities in your systems and applications without necessarily exploiting them. However, with manual testing, we attempt to leverage each vulnerability to take advantage and understand the true severity of each vulnerability. Automated testing is prone to false positives (incorrect findings) and false negatives (missing critical areas of application). At Packetlabs, we don’t rely on automation, in fact, automation is only the first of many steps in our process. Then we begin our manual process where we take the time to understand your systems/applications and then attempt to exploit each vulnerability so that you can uncover where your weakness lies.

5. Quality

We will never compromise on quality, which is why we will never outsource our engagements. Most security consulting firms offer penetration testing, but few maintain a qualified team which involves relying on subcontractors who’s qualifications are not thoroughly validated. Hence, beware of who is actually doing your testing. Ask questions to ensure you have a qualified team.

6. Qualifications

We mandate each of our team of testers to have the most advanced training and certifications available. We understand our clients work in multiple industries that are constantly dealing with sensitive information, which is why we ensure all of our testers are certified, background checked, and have hands on experience. The minimum qualification our team has is the Offensive Security Certified Professional (OSCP), which is a 24-hour practical exam that tests the candidate’s ability to exploit vulnerabilities in an unknown network.

7. Reporting

The last thing any company needs is a report with no real value. We deliver a detailed penetration testing reports that includes an easy-to-understand description of our findings, documented with screenshots, and a detailed attack narrative to illustrate the impact of each potential risk. We also include an executive summary that outlines the overall state of the application and perspective recommendations to enhance the security within the environment.

Putting the Pieces Together

There are so many factors to consider when determining the price of a penetration test, however, the cost of a penetration test outweighs the cost of a data breach. The average data breach in Canada in 2018 costs roughly $4M dollars. Canadian Privacy Law also now states that a failure to notify Privacy Commissioner of a breach within a reasonable amount of time may result in a $100,000 dollar fine.

Data breaches can be costly, eradicate customer confidence, demolish brand reputation, and essentially destroy a business altogether. Hence it is important to invest in a company whose main goal is to improve the security of their clients. Ultimately, the cost of a penetration test is the price of your security. In order to be one step ahead of the hackers, you have to think like one.

A hacker will use any means to get into your network, therefore you want to ensure you choose a company that can provide the highest quality of testing. We simulate a real attack scenario to give you a perspective of the threats in your system and how to mitigate the risks. At Packetlabs, we stand behind our testing and mandate continual training to ensure the thoroughness of our work. Let’s talk.