2 ms·

$10,000 - $12,000 per week is normal for an application security assessment. Go ahead and double that for a specialization like protocol cryptanalysis. Ballpar

by dsacco 9y ago

$10,000 - $12,000 per week is normal for an application security assessment. Go ahead and double that for a specialization like protocol cryptanalysis. Ballpark $40,000; maybe more because there were three consultants, not two. I wouldn't be surprised at the price until it hit $60,000; I'd be outright shocked at $100,000. If you have two or three consultants working on this full time, you're charging $7000 - $10,000 per consultant-week of time. Those numbers would only be shocking to someone who has never been a consultant or who has never engaged in an assessment; the margin is lower than it looks when you account for the peripheral staff aside from the consultants working on the engagement. Consulting for a variety of software specializations very easily hits five figures per week.

sillysaurus3 9y ago
Well, the third pentester was a shadow, which is a wildcard in terms of value and probably wasn't an influence during the initial sales negotiations. Ballpark $40,000; maybe more because there were three consultants, not two. In this case it was a cryptographic review, so it's probably closer to $80k. I forgot to take that into account in my other comment. $40k would be a pretty standard price point for a regular pentest. NCC also incurs additional risk to their reputation when organizations publish documents like this, so another $20k might've been necessary to get them to this point. I'm not positive it works that way, but I know that publishing a document like this is generally more significant than the usual "here's a secret document" deliverable. There have only been 17 public reports in total, for example: https://www.nccgroup.trust/us/our-research/?research=Public+Reports https://www.nccgroup.trust/us/our-research/?research=Public+... So it's a bigger deal on both sides of the table. I think your $100k figure is pretty on-point. Or at least not unrealistic to be closing in on that.

by dsacco 9y ago

sillysaurus3 9y ago

Well, the third pentester was a shadow, which is a wildcard in terms of value and probably wasn't an influence during the initial sales negotiations. Ballpark $40,000; maybe more because there were three consultants, not two. In this case it was a cryptographic review, so it's probably closer to $80k. I forgot to take that into account in my other comment. $40k would be a pretty standard price point for a regular pentest. NCC also incurs additional risk to their reputation when organizations publish documents like this, so another $20k might've been necessary to get them to this point. I'm not positive it works that way, but I know that publishing a document like this is generally more significant than the usual "here's a secret document" deliverable. There have only been 17 public reports in total, for example: https://www.nccgroup.trust/us/our-research/?research=Public+Reports https://www.nccgroup.trust/us/our-research/?research=Public+... So it's a bigger deal on both sides of the table. I think your $100k figure is pretty on-point. Or at least not unrealistic to be closing in on that.