4 ms·

Appsec pentester for 6 or so years: The 1-1.2k a day figure (GBP) is relatively low for 2020. I know you mentioned that i's been a while; just trying to shed so

Appsec pentester for 6 or so years: The 1-1.2k a day figure (GBP) is relatively low for 2020. I know you mentioned that i's been a while; just trying to shed some light. Boutique Firm X billed at 285/hr with an average of 60 hours for a small application. That comes out to $2,280 USD a day. Standard Small Consulting Firm Y billed at 250/hr. In the past 6 years I have yet to see anything below 235/hr, which is still $1880 USD/day (1479, GBP). Hope that helps, GP.

raesene9 6y ago
Worth noting that (IME) US day rates are a lot higher for pentest work :) your US rates sound similar to what I've seen but Morrbo's UK rates sound ballpark right for the UK (I'd have said a little higher but it does depend on the company and work)
- dogma1138 6y ago
  When I did pentesting for a consulting firm the daily rate was £2000-2500 (depending if we had to pay reverse VAT for non UK/SM clients, and some other factors) we worked with financial firms and software companies primarily, there for remote on-site would be the same + expenses. More bespoke services like proper red teaming, DDoS simulation IOT/connected cars/hardware were about double that. £800 a day is the very bottom of the price scale in the UK for general SME public sector companies.
  - rtempaccount1 6y ago
    Let me guess, Big-4? boutiques in the UK don't usually charge that kind of day-rate and the big banks all use their purchasing power to get day rates down. £800/day is low, but not unheard of especially if you use freelancers/small boutiques, but £2k/days is more than I've seen for most things in the UK.
    - dogma1138 6y ago
      No, quite boutique but not a UK firm I was one of 5 in the UK office. We didn’t really deal with retail banks the banking clients would be investment and asset management banks like RaboBank.
  - user5994461 6y ago
    Sounds a bit much. Could you have names of firms running this sort of service? and are they recruiting? When I was working in financial firms, there were internal red teams running vulnerability scanners or manual pentest (manual requires much more planning and coordination) . No point in paying external firms £10k per app to run an automated test. I am gonna have to consider changing side if audit firms are really billing £2-4k a day for this.
    - dogma1138 6y ago
      We didn’t run automated vuln scanners, the majority of the work was app focused grey box testing, VA was only performed in the rare cases where we actually were testing against a live prod environment nearly all of our testing was done pre-production, quite often it would start pre-QA/UAT.

raesene9 6y ago

Worth noting that (IME) US day rates are a lot higher for pentest work :) your US rates sound similar to what I've seen but Morrbo's UK rates sound ballpark right for the UK (I'd have said a little higher but it does depend on the company and work)

dogma1138 6y ago
When I did pentesting for a consulting firm the daily rate was £2000-2500 (depending if we had to pay reverse VAT for non UK/SM clients, and some other factors) we worked with financial firms and software companies primarily, there for remote on-site would be the same + expenses. More bespoke services like proper red teaming, DDoS simulation IOT/connected cars/hardware were about double that. £800 a day is the very bottom of the price scale in the UK for general SME public sector companies.
- rtempaccount1 6y ago
  Let me guess, Big-4? boutiques in the UK don't usually charge that kind of day-rate and the big banks all use their purchasing power to get day rates down. £800/day is low, but not unheard of especially if you use freelancers/small boutiques, but £2k/days is more than I've seen for most things in the UK.
  - dogma1138 6y ago
    No, quite boutique but not a UK firm I was one of 5 in the UK office. We didn’t really deal with retail banks the banking clients would be investment and asset management banks like RaboBank.
- user5994461 6y ago
  Sounds a bit much. Could you have names of firms running this sort of service? and are they recruiting? When I was working in financial firms, there were internal red teams running vulnerability scanners or manual pentest (manual requires much more planning and coordination) . No point in paying external firms £10k per app to run an automated test. I am gonna have to consider changing side if audit firms are really billing £2-4k a day for this.
  - dogma1138 6y ago
    We didn’t run automated vuln scanners, the majority of the work was app focused grey box testing, VA was only performed in the rare cases where we actually were testing against a live prod environment nearly all of our testing was done pre-production, quite often it would start pre-QA/UAT.