Hiring guide
How to read and compare a penetration testing proposal
A penetration testing proposal is the firm's written answer to your brief. It should say what will be tested, how, by whom, when and for how much. If any of those is missing, the proposal is not finished.
- Signed scope before testing
- Fixed price agreed in writing
- OWASP and PTES methods
What a penetration testing proposal should contain
Six parts, each in writing: scope, method, people, deliverables, dates and price. Exclusions belong in the scope, and the retest belongs in the deliverables.
In addition, the proposal should repeat your reason for testing. If it does not, the firm may not have read the brief closely.
Comparing each penetration testing proposal
Put the proposals in one table. Then gaps stand out quickly. A proposal that leaves a row empty is telling you something.
Also compare the scopes before the prices. Because a smaller number often covers less, price alone misleads.
| Part | What to compare |
|---|---|
| Scope | Same systems, same exclusions |
| Method | A named published standard |
| People | Named tester, not a role |
| Deliverables | Report, summary, debrief and retest |
| Dates | Start after authorization, report day |
| Price | One fixed number, no hourly extras |
Penetration testing proposal comparison
Tick what each proposal states in writing.
Your result appears here as you tick, so you can see what is still open.
Red flags in a penetration testing proposal
A price with no scope is a guess. A method described only as industry best practice is vague. A team described only by job titles may change after signing.
Similarly, a long list of optional extras can turn a low headline price into a high final invoice.
Questions to send back
Ask who exactly will test, and what happens if that person becomes unavailable. Ask what is excluded and why. Ask whether the number can move during the project.
Then compare the written answers. As a result, the choice rests on evidence rather than impressions.
From penetration testing proposal to signed scope
Once you choose, the proposal becomes the basis of the scope. Check that nothing changes between the two. Then the system owners sign authorization.
Finally, file the winning proposal with the scope. It shows what was promised.
What our proposals show
A written scope, the methods we follow, the deliverables, the dates and one fixed number. Testing begins within 48 hours of authorization.
Full engagements run from $35,000 to $120,000, and the floor is $25,000. The bounded Focused Exposure Review starts at $4,500. Its fee is credited in full against a full engagement commissioned within ninety days. One fixed number is agreed after the scoping brief, and it never moves during the project. The method follows the Penetration Testing Execution Standard and the OWASP Web Security Testing Guide.
Penetration testing proposal questions
What should a penetration testing proposal include?
Scope, method, people, deliverables, dates and price.
How do I compare two penetration testing proposals?
Compare scopes first, then everything else, and price last.
Is the smallest quote a risk?
It can be, if it covers less. Check the scope row first.
Does the penetration testing proposal authorize testing?
No. The system owner still signs a written scope.
Related guides
Request a penetration testing proposal
Tell us what you need tested, and why. We reply with a written scope and one fixed number.
Get a fixed price