Problems

Client has to compete for work with big and medium sized security companies and therefore relies on their ability to be fast and efficient with time and resources. Client also competes for talent as it is hard to find and even harder to retain good penetration testers.
The problems for this client were:

1. Significant time (and therefore cost) spent by the most senior people on penetration testing logistics - scheduling, scoping, collecting necessary information, and doing quality assurance over the reports.
2. Language barrier – most of their customers expected reports in English, and a lot of their pentesters come from a non-English speaking background.
3. Pentesters being burned out by writing reports.

As the client’s Managing Consultant put it: “If I have to spend my time chasing clients, collecting testing credentials, reviewing reports, and saying goodbye to my best pentesters - who is going to do business development?”.

Solution: AttackForge Community

Community's main purpose is help small security companies and freelancers. It provides proven methodologies, comprehensive vulnerability and issue library, and a secure method of communication with customers.

Client had tried Community with a testing project and then introduced it to the principal pentesting team. The first full pentest was executed in February 2019. Customers’ representatives were invited for the third project.

Results

1. After several projects, the time spent on logistics went down by 50%. Quality assurance (such as peer and tech reviews of the reports) was reduced by 90%.

2. The language issues went away entirely as Community provided the most word heavy components such as vulnerability definitions out-of-the-box.

3. Pentesters are happier as they do not need to write reports any more.

4. The clients' customers reported that the use of Community helped them to track and fix vulnerabilities faster, saving time and money. Community paid for itself after the second project. One day of wages saved on writing reports is more than annual Pro subscription fees.

Will It Work For You?

If you are concerned with having your pentesters happy, and keeping your overheads and costs low – go for Community. Try it for free. If your deliver more than 30 projects then go for Enterprise.

Problems

Since leaving the bank, he had set up his own legal entity, insurances, background checks, purchased all standard commercial tools which are typically used during professional engagements, and was ready to start working as a freelancer. However there were a number of challenges that he faced:

1. No Report templates. Freelancer had no intellectual property rights over previous report templates used at the bank, and needed to create a new report template to use with own clients.
2. Reputation, Trust and Pipeline. As he was only new to this type of work and sales - it was difficult to win work and convince people to go with him, and why he's a better choice than cheaper offshore alternatives.
3. Visibility and Maturity. It was difficult for this freelancer to demonstrate that his methodology and testing coverage would be aligned with client's expectations. The lack of visibility until a report was produced at end of testing meant that he was having to manually write daily status updates each day so that the client could have visbility over testing progress, and what was being covered off daily.

This created additional overheads and stress for this freelancer, which was especially difficult as he was also learning how to run a small business for the first time. As he had put it "I needed something to keep client's happy and coming back".

Solution: AttackForge Community

Community is a full collaboration platform which bring's pentesters and their clients together in one place. For the first handful of projects using Community - he had not invited clients directly to Community project workspaces. Instead he had indicated to them that he was using a tool to help him with tracking and reporting. He was adding his findings daily using the in-built Vulnerability and Issue Library, and ticking off test cases as he went along. At the end of each day, he downloaded the report and sent this to the client.

After getting used to Community - he started to invite client's directly to their project workspaces. This meant that he no longer needed to send them daily updates and that they could log in and see progress for themselves, and download reports when they needed it.

The feedback he had recieved from client's was mostly positive, and importantly helped him to build trust and pipeline as they could see exactly what was being tested (scope), when it was tested (timestamps), how it was tested (test cases), upload details directly to the workspace when needed, and all evidence to help them understand the issue and how to fix it.

Eventually, few of his clients who had got used to Community had requested that he gives access to developers directly so they could see the findings and start actioning them, without the client having to be a bottleneck. This meant that client spent less time and effort managing logistics and communication, which freed up a lot of their time.

Some of the regular clients who were using Community had also started managing their remediation testing through Community. The clients developers' were selecting which issues were ready for retest and requesting a retest round, and the freelancer was able to perform this swiftly and invoice client for the retesting performed.

Results

1. Freelancer no longer needed to worry about maintaining his own report template as customers were happy with the results produced from Community as it was sufficient for developers to understand the issues and how to fix them.

2. Freelancer was able to show new prospective clients his sanitised/de-identified projects to help give him a competitive advantage when bidding for new work. Prospective client's could see that industry standard methodologies were being used and detailed information for findings was being produced. This helped to build trust and win more clients and work.

3. Freelancer was able to create 'stickiness' with his regular clients, as they were now using his Community projects as their defect management tool for penetration testing findings, providing him with regular income and helping him to build his pipeline.

Will It Work For You?

If you are a freelance penetration tester and you need a tool to help take some pressure off you and keep your clients happy - Community is for you. It is free to sign up and start using immediately. However if your client's requirement is to have their data isolated and not stored in a multi-tenant solution, then Community is not for you.