What to send a penetration testing firm for a quote
A firm prices a test from what you tell it. Send the same short description to every firm and you get quotes you can compare line by line, without a round of back-and-forth first.
What is in scope
Name each thing you want tested, and say how big it is. Size is what turns into days, and days into price.
- Web applications: the address, roughly how many pages or functions, and the user roles (for example customer, staff, admin).
- APIs: how many endpoints, and whether documentation such as an OpenAPI file exists.
- External network: the IP addresses or ranges and domains that face the internet.
- Internal network: roughly how many hosts and sites, and whether testers come on site or connect remotely.
- Cloud: the provider, how many accounts or subscriptions, and the main services you use.
- Mobile apps: iOS, Android or both, and the API behind them.
Say what is out of scope too, such as a payment page run by your provider.
Where and when it can be tested
- Environment: live, or a test copy that matches it. Testing live systems needs more care, and some firms price it differently.
- Window: dates or times testing may run, and any blackout periods such as a product launch.
- Hosting: who runs the systems. On AWS, Azure or Google Cloud, read the provider’s testing rules (AWS, Microsoft, Google Cloud). If a third party hosts them, you may need its permission.
Why you are testing, and the report you need
The reason shapes the report. Say whether the test is for a customer’s questionnaire, an audit such as PCI DSS, ISO 27001 or SOC 2, an insurer, or your own assurance after a change. If someone else will read the report, say who, and whether you need a short summary you can share with them. Ask whether a retest of fixed findings is included.
The NCSC’s penetration testing guidance describes a typical engagement as scoping, testing, reporting and follow-up. A request that covers what to test, the rules, the report and the retest lets a firm price all four.
Practical details
- Your deadline for the report, and when you want testing to start.
- Any accreditation you need, such as CREST, or CHECK for public sector systems.
- A budget range, if you have one. It helps a firm suggest a scope that fits.
- Who to contact during the test, especially if something stops working.
Keep passwords, test accounts and network details out of the first email. Send them once you have chosen a firm, the way it asks you to.
Next steps
Sources
- NCSC: Penetration testing guidance
- CREST: A Guide to Penetration Testing
- AWS: Penetration testing policy
- Microsoft: Security testing rules of engagement
- Google Cloud: Acceptable use policy
Frequently asked
Can I get a quote without knowing the exact scope?
Yes, as a range. Describe what you have, such as one customer portal with an API, and the firm will ask questions or run a short scoping call. The more precise the description, the narrower the range and the fewer surprises later.
Should I send passwords or test accounts with the request?
No. Send them only once you have chosen a firm and agreed the terms, and through the channel the firm sets up for it. The first email only needs to say which roles or account types the testers will need.
How many firms should I ask?
Two or three is usually enough to see the range of prices and approaches. Send each one the same description, so the quotes are comparable.
Find firms that fit your test
Answer a few questions about what needs testing and why, and see matched firms with a link to each one’s contact page.
Match with firms