Hacker News Reader

Comment by no-dr-onboard | Hacker News Reader

Appsec pentester for 6 or so years: The 1-1.2k a day figure (GBP) is relatively low for 2020. I know you mentioned that i's been a while; just trying to shed some light.

Boutique Firm X billed at 285/hr with an average of 60 hours for a small application. That comes out to $2,280 USD a day.

Standard Small Consulting Firm Y billed at 250/hr. In the past 6 years I have yet to see anything below 235/hr, which is still $1880 USD/day (1479, GBP).

Hope that helps, GP.

View on HN

Worth noting that (IME) US day rates are a lot higher for pentest work :) your US rates sound similar to what I've seen but Morrbo's UK rates sound ballpark right for the UK (I'd have said a little higher but it does depend on the company and work)

When I did pentesting for a consulting firm the daily rate was £2000-2500 (depending if we had to pay reverse VAT for non UK/SM clients, and some other factors) we worked with financial firms and software companies primarily, there for remote on-site would be the same + expenses.

More bespoke services like proper red teaming, DDoS simulation IOT/connected cars/hardware were about double that.

£800 a day is the very bottom of the price scale in the UK for general SME public sector companies.

Sounds a bit much. Could you have names of firms running this sort of service? and are they recruiting?

When I was working in financial firms, there were internal red teams running vulnerability scanners or manual pentest (manual requires much more planning and coordination) . No point in paying external firms £10k per app to run an automated test. I am gonna have to consider changing side if audit firms are really billing £2-4k a day for this.

We didn’t run automated vuln scanners, the majority of the work was app focused grey box testing, VA was only performed in the rare cases where we actually were testing against a live prod environment nearly all of our testing was done pre-production, quite often it would start pre-QA/UAT.

Let me guess, Big-4? boutiques in the UK don't usually charge that kind of day-rate and the big banks all use their purchasing power to get day rates down.

£800/day is low, but not unheard of especially if you use freelancers/small boutiques, but £2k/days is more than I've seen for most things in the UK.

No, quite boutique but not a UK firm I was one of 5 in the UK office.

We didn’t really deal with retail banks the banking clients would be investment and asset management banks like RaboBank.

Reply on news.ycombinator.com