3 ms·

>and I was never asked back to that clients site ever again. Award for excellence in pentesting.

• Aachen 6y ago
  Some companies need to be tested for legal reasons or because the parent company requires it. It's often easy to tell when you're dealing with one of those from the details being incomplete or coming in late (like get the API docs 7 days into the 5-day test - so we basically didn't test, but we still have to bill the reserved time), but if it's unclear, being a little too happy with an empty report and inviting us to test another thing is another tell-tale. Well, the report is never empty but in general it's not as if you always hit jackpot, sometimes there's a very small attack surface in a black box test (or if it's a black box because your account credentials are still not arranged...), sometimes there's a mostly default install of something and that's secure by default because a lot of people already looked at the project, or sometimes they just did a good job. Not being invited back can be more than one thing. Embarrassing the company is one of the most effective way of losing clients, though. It also doesn't help get issues fixed because the manager will prioritize saving face over anything else, including protecting assets. If you enable them to protect assets without looking bad using good communication... that manager will want you for every test.