Stefano,
Yes, I agree that this is very difficult in most cases. I recently had
to prove that I was better than other bidders jocking to do a global
pentest for a Fortune 1000. The customer had no idea what the
differences were between a vulnerability test and a pentest. First, I
had to educate the customer about security testing in general. Second,
I had to provide the customer with strong references from other pentest
project. Third, I had to explain why my pricing was up to 11 times
higher than other bidders. Most of the other bidders were companies
that sell security software and one was a MSSP, who pricing for the
project was ZERO. The MSSP was also bidding to obtain a 1 million
dollars managed services contract. Fourth, the customer provide each
bidder a single IP to test. I was the only one that correctly
identified the OS, web application and vulnerabilities on the system.
Fifth, I had to provide a sample document, which I refused to do since
even a sample reports can be too detail.
I finally won the project, but only a piece of the overall project. The
customer gave part to the MSSP who costs were nothing and the rest to
me, but only after I cut my pricing based on the new project details.
The biggest issue that I have in pricing projects today is with the
security software vendors and MSSPs that want to sell their wares to the
customer!!! BUT only after they do a vulnerability test or pentest for
FREE!!!!
Intel96
Stefano Zanero wrote:
And lastly you should always be prepared to negotiate the pricing with
the customer. The customer will always find someone cheaper and you
will have to prove why you are better for the extra cost.
This is very difficult if your customer does not have an exact idea of
what a pen-test is supposed to be.
What kind of proof would you suggest bringing to help a customer
understand the difference ?
Stefano
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------
