Somebody needs your pen test report by the end of the month. So you go looking for the fastest one you can find, and you compare how quickly each firm delivers a report.
That's the wrong number. If the person asking wants to see that your critical findings got fixed, the first report isn't the one you're waiting for. You're waiting for the last one.
The three deadlines
- First findings. The tester finishes and tells you what they found.
- Your fixes. Your engineers fix those findings and deploy them. This is the only part the tester doesn't control, and it's usually the part nobody planned for.
- Retest and final report. The tester checks the fixes and issues an updated report showing the status of every finding.
Work backward from your real date. Ask your engineers how much time they can clear for security fixes, before you know what the fixes are. Book that time now, because otherwise it comes out of a release.
There's also a deadline before the first one
An external test can start right away, since all it needs is your domain. That's how we turn our $495 test around in 24 hours. It looks at your app from the outside, without a login.
An authenticated test can't move that fast. Somebody has to agree the scope, create test accounts for each role, get MFA working on them, pick a test window, and allow a source IP. If you want a quick start, have the accounts and your API spec ready before you make the first call. It's the one part of the schedule you can speed up on your own.
What to ask before you pay
Send these to any firm you're considering, including us:
- Does the advertised offer cover authenticated web app and API testing, or is that a separate engagement?
- What's the earliest start date, and what do you need from us to hold it?
- When do we get the first findings?
- How quickly can you retest once we deploy fixes, and how long after that do we get the final report?
- What's the total price, including the retest and the updated report?
- Can we see a sample report, and who's doing the testing?
Pay attention to dates that come with conditions. "Three days" might mean three days after you've signed and handed over working accounts. That's normal, but you want to know it up front.
Check the final report
Before you send the report on, read it the way your reviewer will. Check that it's marked final and signed, not a draft or a version waiting on a reviewer. Reviewers notice that. Make sure the status of each finding is current, and that the test dates are the real ones.
And go in knowing a fast test won't get you a clean one. You can't buy zero findings. If something real turns up, you fix what matters and decide what to do with the rest. A report that shows a finding and its fix can read better than one that claims nothing was wrong.
If your deadline is tight and you need the hands-on kind, here's how our authenticated pen test works, with one retest and an updated report included. Tell me your date and I'll tell you honestly whether we can make it.