Summary: Security tester is paid to scan a bank, finds a vulnerable asset, reports back to the customer. Customer tells him he doesn't charge enough. Here's my

Summary: Security tester is paid to scan a bank, finds a vulnerable asset, reports back to the customer. Customer tells him he doesn't charge enough. Here's my take: if he is charging $7, $10, $40, whatever, he's running automated scans. If the customer is suggesting they'd be willing to pay $10k, they are most likely under the impression this is a real, full-fledged pen-test. That is a massively dangerous assumption. A real pen-test is not just some process you kick off and walk away. It involves real investigation, testing, and analysis. Charging $7, $40, would bankrupt a tester.