got plenty of views for one question (around 2.5k in 1 day), but there arent any good answers

The question was about the pen-testing and contract fulfillment, whatever I need to exploit something or just find vulnerability

somebody argued that he can do automated test himself

So I think the right pen-test would try to find more vulnerabilities then automated test

and it would include not only list of the vulnerabilities, but also good, actionable analysis of the issue

and basic exploitation is still required to prove the point beyond doubt, things like cross-site scripting

and also some brute-force won't be bad

Different customers have different expectations.

yeah, my idea was to maximize the list of issues (going wide), instead of going deep when it's not always successful

however, with relatively easy / obvious issues, some exploitation would be good

that would include login boxes, websites

but some people may want to do different things

and to have good analysis

@Aria Wide is only valuable if there's guidance as to severity - it is easy to hand someone a thousand page report if you go too wide. To me, a pentest should help guide the organization as to what needs to be fixed NOW, because the reality is that it can't be all fixed instantly (or even at all sometimes..)

If the issue is obviously bad, then I don't need to see an exploit. Exploits only matter if it's not clear if an issue is actually a problem.

Which is why I like actual pentesters to concentrate on showing me the exploit, rather than giving me output of tools that say 'there might be a problem here'... Tools give lots of false positives and false negatives. I'm not discounting them in my answer, but if I'm coughing up pentesting bucks / internal pentesting hours, I want focus on what can be exploited

Basically, as a blue team guy, I'm drowning in tools output - I've got SAST tools, software composition analysis tools, dynamic application testing tools, I got SIEM reports, I got 'wide' all day long. But if I want deep, I need to put in the grunt work to dig in, figure out what's real, what's not.

With a pentest, I want you to do that work - I want a PEN test - can you get in? What's the obvious route? I want to see the failures - it shows me where my defences work. I want to especially see successes. I got an infinite number of 'maybes' already. Anyways, that's my perspective and that's what I was trying to get across in the answer. I'll let someone else answer :)

okok

I think showing the real stuff is very important

Anyway, as example, PHP 4 from 2007 but built in a way that most of exploits wont work, therefore it's vulnerable but not exploitable

anyway, showing up the real issues is not that difficult assuming it's possible to start by gaining some low-level access

so the pentest done from outside is one thing, but it can be done from other employees privilege level as well, which I think it's good to ask for

Yeah, I agree with that.

From an organisational standpoint, a pentest is also a useful tool to give voice for the security concerns that are already present but not acted upon.

What do i mean: in an organisation big enough employees may have security concerns that are not acted by management. And it is needed a pentest report to force action to be taken

In other words saying: "Our company gives paramount importance to information security." and then publishing all SFTP passwords on the wiki. Is easy.

Being auctioned for a pentest report which contains: "Passwords to all FTP sites, for all departments, are available on the wiki for all employees"

is a different story

Even better is "And we used that access to reach..." - I've seen too many "no brainers" de-prioritized in my time...

(explicitly not talking about my current employer there :) )