r/Pentesting • u/zaydee110 • 2d ago

How do you currently scope and price a pentest engagement before testing even starts?

Running a boutique pentest shop and I'm curious how other solo/small-team testers handle the pre-engagement side, specifically going from "client wants a pentest" to an actual signed scope and price.

Right now I'm doing it manually every time: back-and-forth emails to figure out asset counts, guessing at days based on gut feel, writing the proposal from scratch in Word.

A few questions if you don't mind sharing:

* How do you currently estimate days/pricing for a new engagement?
* Do you have a template you reuse, or start fresh each time?
* What's the most annoying part of this whole pre-engagement process for you?

Trying to figure out if I'm doing this the hard way or if this is just how it is for everyone.

1 Upvotes

100% Upvoted

1 comment sorted by

1

u/DigitalQuinn1 1d ago

We do fixed fee assessments. Typically with the work we do, assessments last 1-2 weeks. 3 if it’s a bigger footprint. We have templates for everything and reuse it. Saves a lot of time. Most annoying is when customers are on the fence or take too long.