Apples to Apples

Luke McOmie, a long-time penetration tester who later ran security practices as an executive, argues that organizations often spend large budgets on security services that do little to improve their posture. He points to a gap between the people doing the work, the people buying it, and the firms selling it, and says scoping, bidding and reporting are where buyers usually lose value.

He walks through three real engagements. An insurance company that started with a routine annual test moved to a programmatic approach with continuous assessment, and its accepted risk dropped sharply. A large outdoor entertainment company ran a long RFP, chose the cheapest qualified bidder, and got a repeat of work it had already done, followed by a phishing compromise. A software firm that had been compromised paid for a thorough test that reached domain administrator access within minutes, which its previous cheaper provider had missed. He also covers how PCI scopes are often tested only from outside, how templated scanner output and padded reports fail to show impact, and how insurers may reject such work.

He closes with practical advice: ask for a sample deliverable before buying, require hours and hourly rates broken out in the bid, confirm which consultants will do the work, hold a recap call after each meeting, and expect testers to go beyond the first default attack path. Buyers should drive the scope from their own risk goals rather than from checkbox requirements.