Lost $220 on a pen test that missed the obvious stuff

Tbh I paid a firm to do a full API pen test on our payment endpoints and they came back with a clean report after 3 weeks. A month later a buddy of mine found an IDOR just by poking around with a free tool. Has anyone else had better luck with smaller shops or individual researchers instead of the big companies?

1 comments

1 Comment

vera_campbell1mo ago

That 3 week turnaround alone tells me they were just running automated scanners and calling it a day. So my question is, did they give you the raw test data or just the pretty PDF report with a green checkmark? Cause if they didn't walk you through every single endpoint they actually touched, you got a checklist, not a pen test. I've seen big firms charge 10x for half the effort, and honestly your buddy finding that IDOR in a day says way more about the tooling than your security.