Paid $120 for a 'security audit' that just ran a free scanner

Last month I got an email from a company promising a full network audit for my home office, so I paid $120 upfront. They sent back a 4 page PDF that literally showed the same results as the free version of OpenVAS I already ran myself. Has anyone else had a service pull this kind of lazy scan-and-report trick, and how do you spot the legit pentest folks from the script kiddies?

2 comments

Log in to join the discussion

Log In

2 Comments

luna_jackson2813d ago

120 bucks for a copy paste of a free Nessus or OpenVAS report is rough. I got burned the same way a few years back, the guy even left the default scan policy name in the PDF, that was my clue. Ask for a sample report and a scope doc before you pay a dime, real pentesters show you what they'll test and how, not just a scanner dump. Also check if they have a cert like OSCP or a CISSP on staff, script kiddies usually dodge that question. Legit folks will also want to talk about your setup first, not just take your card and email you a PDF.

2

thomas_wright4113d ago

Did they really leave the default policy name in there? That is brutal, sorry you had to deal with that nonsense. Asking for a sample report up front is solid advice, way too many people just hand over cash and hope for the best.

1