You can get it cheaper but a lot of it - for better or for worse - really comes down to the skill of the individual consultant. You can pretty much halve these prices, but then you'd end up getting stuff outsourced to India and it wouldn't be any good. Depends if you care about the security of your product or just want a box ticked for some arbitrary compliance and want it done as cheap as possible.
I haven't been a tester/consultant for a few years now, but the prices hold up. That being said one development which has happened since I've left the industry is the advent of crowd sourced pentesting. I know a lot of friends who moonlight with these things and are very good at their jobs, and the rates are lower. The name crowd strike comes to mind, but I'm not 100% sure if that was the company or not. I know a lot of good UK based companies (if it's a web app/remote then the physical testers location doesn't matter) if you needed.
Boutique Firm X billed at 285/hr with an average of 60 hours for a small application. That comes out to $2,280 USD a day.
Standard Small Consulting Firm Y billed at 250/hr. In the past 6 years I have yet to see anything below 235/hr, which is still $1880 USD/day (1479, GBP).
Hope that helps, GP.
More bespoke services like proper red teaming, DDoS simulation IOT/connected cars/hardware were about double that.
£800 a day is the very bottom of the price scale in the UK for general SME public sector companies.
When I was working in financial firms, there were internal red teams running vulnerability scanners or manual pentest (manual requires much more planning and coordination) . No point in paying external firms £10k per app to run an automated test. I am gonna have to consider changing side if audit firms are really billing £2-4k a day for this.
£800/day is low, but not unheard of especially if you use freelancers/small boutiques, but £2k/days is more than I've seen for most things in the UK.
We didn’t really deal with retail banks the banking clients would be investment and asset management banks like RaboBank.
Accountability and consistency is a real concern in crowdsourcing. There is a reason we dont spend too much time designing an idea and then crowdsourcing all development. Why would security be different?
The discussion of relative merit of bug bounty versus a pentest is well trod ground, so I won't rehash here except to say I would never consider a bug bounty replacement for a pentest, and if you're asked for a pentest report as part of third-party vetting etc. many organizations will be concerned to see a bug bounty program compiled report.
The latter example sounds like https://cobalt.io/. I've seen several reports and all I can say is if I were vetting a third-party or otherwise looking for assurance of security posture I would still want to see a "real" pentest from a reputable firm.
I dont want to name companies and start a war, but the industry is moving in a dangerous direction with some of the other options -- there are companies offering pen testing where those companies have no full time employees. They post the scope, and their registered users can sign in, take the work, and deliver it. Quality is all over the place. And things like confidentiality, data processing, etc, and any way to confirm a corporate entity adheres to their contractual obligations? Nonexistent.
On average I'd even say that my day rate went down compared with 10 odd years ago - when you needed an interview at GCHQ to get CHECK - as there were just few people doing it whereas there are loads now.
I think it's a bit sneaky as for a product like this, people expect this to be a code and crypto audit. The "network" part should be emphasised and in the title of the page, instead of just the PDF.
* expensive commercial vulnerability scanning tools.
$8k - $12k for a "platform" that hires 100% outsourced pentesters of highly variable skill and quality, and takes no liability themselves, and whose pentesters are located in developing countries and good luck getting damages out of them, ever, regardless of their platform "reputation" pretend points. also communication tends to be difficult as the norm is ESL.
$25k for a US-based boutique firm with in-house pentesters of vetted high quality, who accept liability and against whom you can actually expect to enforce an NDA and/or extract other damages. source code and design audit starts at about this price.
then, you can run your own program on top of the bounty platforms, however scope and focused work is not going to happen (a lot of the work is boring), and it will cost you a lot of your own time. the money you save DIY is not worth your own time investment.
if you actually want a good pentest, go with a boutique, quality firm. if you want something to give to an auditor or to meet a VSA, go with cheap.
You can get something like that for £5-10k if you go through one of the typical audit firms (KPMG, Deloitte and co).
In addition you can look into some ISO certifications or industry specific regulations. It's basically a checklist of a thousand questions: do you use TLS? are your applications protected by authentication? can custom folks access personal data of customers? are there audit logs of support accessing customer information?
What you want or need will fit somewhere in between.