RE: Pen-test pricing

["Tyler Markowsky" <tyler.markowsky () seccuris com>]

Andre:

Your pricing should be based on estimates of average time spent on device
analysis.  You should scope your project per device and price per hour.

I.e.: 5 minutes of analysis per device for 11 devices.  If you charge (not
cost) 50 dollars an hour, you would charge: 50 bucks.

Also, you should be cognizant of your costs for travel and accommodations
(if there are any).  Some clients require you to scan onsite, while others
allow tunneling.

Best,

Tyler Markowsky
Information Risk Analyst
Seccuris

http://www.seccuris.com


-----Original Message-----
From: Andre Derek Protas [mailto:randori82 () hotmail com] 
Sent: Thursday, February 03, 2005 8:22 AM
To: pen-test () securityfocus com
Subject: Pen-test pricing

Does anyone have any good figures on pricing for pen-tests?  Is charging 
done per server, location, or hour?  Any help would be appreciated.

::andre::

_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today - it's FREE! 
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/