Well I don't want to turn this into a company-specific debate, so I'm just addressing the position that running burp's scanner or sqlmap is "low quality". I hav

Well I don't want to turn this into a company-specific debate, so I'm just addressing the position that running burp's scanner or sqlmap is "low quality". I have a few issues with that position and your justifications. I wouldn't bill a client for running a scan on them. I would start a scan and do manual testing at the same time, focusing on more intelligent attacks and understanding the application. By the time I am done, the scan would typically kill off a significant number of buggy parameters that I now don't have to test because I already know it's as vulnerable. For some projects, this can be quite substantial. Beyond creating a POC and documenting the issue, I now don't have to spend billable hours on all of that. The fact that scans consistently find a lot of bugs tell you that clients aren't running tools themselves. They don't know the tools, don't understand the results, don't know how to use them beyond point-and-click. They don't know how to set up macros that validate the session and re-log in, etc. Although it sounds good to say that they aren't paying you to just run a scanner, the reality is no other reputable testers are doing that either. Yeah, it was a bit snide, but you were scoffing at testers who do use scanners, and I genuinely think not using them (properly) is a colossal waste of time