3 ms·
Penetration testing is not really software engineering consulting, and security spending is about as far as you can get from anchoring pricing to value. It's cl
by lawnchair_larry 11y ago
Penetration testing is not really software engineering consulting, and security spending is about as far as you can get from anchoring pricing to value. It's closer to selling insurance, but the value is even more dubious.
The exception might be in cases where a company is already spending a lot on security by doing it poorly, and you show them how to do it better. But, that is pretty much none of the market that I've seen.
- tptacek 11y agoOur modal project was part of the software engineering budget of a software product company. I think you may think Matasano was more of an IT shop than it actually was. The term "penetration testing" doesn't do anyone any favors, since it means everything from "running Metasploit" (the kind of work we did not do) to "evaluating firmware". This is really neither here nor there, right; the more specialized you want to say our work does, the stronger my consulting advice gets.