3 ms·
That seems to me to be mostly limited to automated tools, or checklist level evaluation? The good/dangerous bugs require creativity and deep system knowledge t
by albntomat0 6y ago
That seems to me to be mostly limited to automated tools, or checklist level evaluation?
The good/dangerous bugs require creativity and deep system knowledge to find, which is hard to trust that an unknown person has.
- ozim 6y agoThen comes risk management and I would tell you "good bugs that require creativity and deep system knowledge to find" are not dangerous. It is sexy and all to sell "we hacked you using emacs through sendmail by the moon phase exploit that happens every 2 months". But really how many people will be able to exploit that? My company is not target of a state sponsored actors. Automated tools, checklist evaluation and decent administrators will be good enough for most of companies. Ordering pentests from time to time is good practice to check if administrators are doing their job as in "trust but verify".
- bashwizard 6y agoIt's not. Running scanners and report scan results won't get you paid so it's a complete waste of time. Trust is easy. You either have a proof of concept and can show impact in your report or gtfo basically.