Re: Just getting started in pen-testing

["Adriel T. Desautels" <ad_lists () netragard com>]

Morbel,
	Before you start a company you need to do a lot of homework which  
you've apparently not done. You need to first decide what your company  
will offer then you need to determine if there is a market for that.  
Then you need to identify the other players and figure out what your  
competitive advantage is.  Then you need to make sure that your  
customers will recognize your advantage and that it really is an  
advantage. Once you've done all of that then you've verified that a  
market exists and you should be able to play in it.

	I'd also suggest that you refrain from posting any emails like this  
to mailing lists because these emails will turn your customers away.  
These emails demonstrate a lack of experience in the industry and that  
is not what your customers are going to want. Either way, do your own  
homework because we can't do it for you without learning what your  
trade secrets are. If we learn that, we'll put you out of business.


On Nov 8, 2008, at 4:55 AM, m0rebel wrote:

> I just started a penetration testing company called Bandit Defense. My
> website is http://www.banditdefense.com and it has a lot of
> information on services that I offer.
>
> Does anyone here have experience doing freelance penetration testing
> as an individual, rather than working for a larger company? I would
> prefer to start with
> working with small businesses and organizations rather than big
> companies, and I'm looking for some concrete ideas on marketing my
> skills. What type of small businesses are normally in the market for
> pen tests, and how big is this market? What kind of work do they
> normally need done? Also, as an individual just starting to do this
> professionally, how should I go about pricing my services? Any advice
> you all have would be very helpful.
>
> For some background, I've been working with computers, mostly doing
> database-driven website development, for about 8 years now, and
> security has always been a hobby. I have Offensive Security Certified
> Professional (OSCP) and Offensive Security Wireless Professional
> (OSWP) certifications, and I have a lot of experience pen testing in a
> home-lab environment and informally with some friends. I've been
> published in 2600 Magazine.
>
> Thanks so much,
> m0rebel
>
> ------------------------------------------------------------------------
> This list is sponsored by: Cenzic
>
> Security Trends Report from Cenzic
> Stay Ahead of the Hacker Curve!
> Get the latest Q2 2008 Trends Report now
>
> www.cenzic.com/landing/trends-report
> ------------------------------------------------------------------------

Adriel T. Desautels
ad_lists () netragard com




------------------------------------------------------------------------
This list is sponsored by: Cenzic

Security Trends Report from Cenzic
Stay Ahead of the Hacker Curve!
Get the latest Q2 2008 Trends Report now

www.cenzic.com/landing/trends-report
------------------------------------------------------------------------