Penetration test scoping questionnaire
The reason three quotes for the same test differ by five times is almost never that two firms are overcharging. It is that all three understood the request differently. This writes the request down once so they cannot.
Answer the questions below and this produces a scope document: what is being tested, how much of it there is, what access the tester will have, what is out of bounds, and what you expect to receive. Send the same document to every firm you approach. The prices that come back then describe the same engagement, which is the only way to compare them.
The document appears on this page and you can copy it straight out. Nothing is emailed anywhere unless you ask for it at the end.
On its way
Check your inbox shortly. If you would rather talk it through, book a time.
Why one document changes the prices you get
Send three firms an email saying you need a penetration test of your platform and you will get three different products back. One quotes an unauthenticated scan of your public surface. One quotes five days across two roles. One quotes twelve days across every service with a retest. All three answered the question you asked, and none of the three numbers can be compared with the others.
A written scope removes that ambiguity. It also tells the firm you know what you are buying, which turns a sales call into a technical one. Firms routinely respond to a scope document with useful challenges, which is free consulting from people who test for a living.
What a firm will ask after reading it
Expect three or four follow-ups, and treat them as a quality signal rather than an obstacle. How many distinct authorization decisions does the product make, which is roughly roles multiplied by object types. Whether the staging environment shares the production authorization code. Whether the cloud account in scope is the one hosting the application or a separate one. What the busiest period is, so testing avoids it. A firm that quotes without asking anything has not read it.
After the quotes come back
Compare on tester days first, price second. Then check the retest terms, the named methodology and whether a sample report is available, which are the checks on how to evaluate a testing firm. If the numbers are still far apart, the gap is overhead rather than scope, and the cost calculator will tell you which end of the range is realistic.
Send this scope to Canadian firms
We will put the same scope in front of firms that do this work, so the numbers you get back describe the same engagement.
Get matchedCommon questions
Do we need a scope document to get a quote?
No firm requires one, and that is exactly why quotes are hard to compare. Most buyers describe the engagement over a call, each firm takes different notes, and the prices reflect three different understandings. Twenty minutes spent writing it down once is the highest-value work available to a buyer in this market.
What if we do not know the answers yet?
Answer what you can and mark the rest as open in the document. A scope with three open questions is still far better than a paragraph of prose, and the open questions tell the firm where to focus the scoping call. The one worth resolving before you send it is which environment will be tested, because it changes everything downstream.
Should we tell firms our budget?
Tell them the day count you expect rather than the dollar figure. A budget number anchors every quote to it and you learn nothing. A day count invites a firm to disagree with your estimate, which is the useful response, because their reasoning tells you whether they understood the system.
Is it safe to send our architecture to several firms?
Send the scope document to all of them and hold the detailed material until a mutual non-disclosure agreement is signed, which is standard and takes a day. The scope document is written to be sendable on its own: it describes shapes and counts rather than addresses, versions and credentials.
Does this replace a scoping call?
No, and it should not. It makes the call short and technical instead of long and exploratory. The call is where a good firm challenges your assumptions, and that conversation is worth having with each of the firms you shortlist.