3 ms·

> The level of external pentesters I've seen, has not exceeded the "scriptkiddie" level. You get what you pay for. I've taken part in security audits that deli

• GekkePrutser 6y ago
  Good point. I'm not sure how much we pay for these as they're not commissioned by me. But knowing the company it's not going to be too much :)
  • secgoon 6y ago
    Most pentesters / offensive security professionals have to operate with their hands tied behind their backs. Management generally has no interest in a real report of what happens if someone actually tried to break in. Generally speaking pentests are often so limited in scope and what is allowed to be engaged that you might have a group of people perfectly capable of robbing you unable to show you how because the company doesn’t want to know the truth.
    • GekkePrutser 6y ago
      Indeed, what you describe sounds very typical! Especially pre-Wannacry, since then things have improved somewhat, when top management woke up to the thought that these things do in fact actually happen.
• ozim 6y ago
  Scriptkiddie level people should just be honest that they are doing checklist audits to see if administrators are doing their job. But unfortunately we are on the hype train where everyone needs to be "cybersec/offensive/pentester/ethical hacker". In the end, cannot really blame them entirely because otherwise CEO and CFO types are not going to hire them and they won't earn money.