3 ms·

I have literally worked alongside external pentesters for some of those organizations you allude to. I still remember their codenames. They might have the scal

I have literally worked alongside external pentesters for some of those organizations you allude to. I still remember their codenames. They might have the scale to have internal pentesters nearly as isolated as external pentesters. A ten person startup definitely does not. Regardless of what tools you use, an internal pen test isn't the same. Do internal accountants use different tools than KPMG? Probably not. The RFP likely did contain more precise language. I encourage you to reflect on your position. It's very odd to me that your attitude is, "if the customer didn't want to be lied to, they should've tied me down better, because I'm like a djinni who will twist your words against you if there's the slightest ambiguity." I understand the sentiment that RFPs and contracts need to be locked down. I don't understand the sentiment of, "they had it coming."

l33t7332273 3y ago
> Regardless of what tools you use, an internal pen test isn't the same It isn’t the same as an “official” pen test for a 10 person company with non-specialists, sure. But the document, to our knowledge, didn’t ask if they had some specific form of pen test. > because I'm like a djinni who will twist your words against you if there's the slightest ambiguity. They aren’t twisting anything. If a quick and informal pen test meets their definition then they should be more specific.