Running a Pentest? Watch Out When Hiring Hackers!
Running a pentest? What should you look out for when hiring hackers? In this blog we tell you more about the preliminary stage of a pentest.
Hiring a hacker can add great value to your organization. An ethical hacker can help you gain insight into vulnerabilities in your company network, mobile, or web application. With the growing cyber threats facing individuals and organizations, it is important to protect your systems against hackers and other malicious actors. With a professional hacker, you can secure your systems and protect sensitive data against cyberattacks. You do this by running a pentest. But what should you look out for when hiring a hacker?
Hiring an ethical hacker?
The first step in hiring a hacker is to find a reputable organization. Check references and talk to the ethical hacker about their previous findings and hacks. Also consider reviews you can find online. If this feels trustworthy, it is often an organization you can rely on in the future. The expertise of an ethical hacker can also vary. For example, a mobile pentest (app) is different from testing a website.
Cost of running a pentest
Besides finding a good hacker, it is also important to consider the price. The cost of hiring a hacker can vary depending on the services the hacker offers. Experience also plays a role, as does the time the ethical hacker schedules to carry out the pentest. At Tozetta, we always recommend having multiple conversations. We provide a price indication based on an intake conversation and a Quickscan. Above all, compare the hourly rates and the estimated hours per component.
A simple example you might encounter is that provider A has a low hour estimate for the pentest, while provider B has a much higher one. This makes provider A cheaper, but provider B may already have spotted something provider A has not. Have the conversation and ask the pentest quote provider for clarification. Questions that can help you along the way:
-
Provider A gives an hour estimate of 20 hours for hiring a hacker, you say 28 hours — can you explain this?
-
You mention a report including a remediation scan — can you send an example of this?
Pentest quality
Another important aspect of hiring a hacker is the diligence with which the hacker and organization operate. You want to make sure the hacker takes all required safety measures and does not cause unintended damage to your system. Beforehand, you can ask the hacker for a summary of the measures they take to handle your system safely.
A cyber security company that focuses on ethical hacking knows exactly which measures they take to safely pentest your systems. Besides having conversations, it is important to draw up a contract with the organization carrying out a "Pentest". The contract should state all information about the services the hacker will provide and the payment they will receive for it. A liability waiver must also be signed, confirming that the hacker is legally permitted to digitally attempt to break into your systems.
Want to know more about running a pentest
Hiring a hacker is an important part of protecting systems against cybercrime. Besides hiring the right party, there are many more challenges involved in running a pentest. Curious what these challenges are? Read about it in our blog Pentest challenges!
As a cyber security company specialized in ethical hacking, Tozetta aims to boost your cyber security. Looking for 1-on-1 advice? Get in touch with us. Hiring a hacker? We're happy to think along with you, without obligation.
Also, when you want to keep continuously testing your cyber security for vulnerabilities, we have the ideal solution for you: Tozetta's hacking as a service subscriptions!