A pentest is one of the most-often sold, most-often wasted security tools in the SME market. Ordered too late, too early or with the wrong scope, it becomes an expensive report that lands in a drawer. It should be the moment where you find out where you actually stand.
We've seen the same script a few times in the last two years. An insurer or a big customer writes "annual penetration test required" into a questionnaire. The owner calls their IT provider, gets a 15,000–20,000 PLN quote, signs it. Three weeks later they get a 40-page report where the first five findings are: RDP open on a public IP, no MFA on the admin account, default password on the router, unpatched Windows Server 2012, no network segmentation. Conclusion: the company is vulnerable. Cost of this insight: 18,000 PLN net.
The problem isn't the pentest. The problem is the order things happen in.
What a pentest actually checks
A penetration test is a simulated attack performed by a human (or a team) trying to breach a specific system in a defined scope. It's not the same as a vulnerability scan — a scanner checks "does CVE-2024-xxxxx apply here". A pentester checks "can I take that CVE and pivot from it to the database server and pull data out".
Keep the two apart. Offers often blur them on purpose.
- Vulnerability scan — an automated tool (Nessus, OpenVAS, Qualys) walks IPs or apps and matches signatures. Cost: 2,000–5,000 PLN. Repeatable, cheap, blind to context.
- Penetration test — a human with tools thinking like an attacker. They find chains of small mistakes that a scanner misses. Cost: 15,000–60,000 PLN depending on scope. Valuable — but only when there's something worth testing.
- Red team — a real adversary simulation over weeks, with phishing, physical entry, MFA bypass attempts. Cost: 80,000 PLN and up. Almost never makes sense in an SME.
Most companies that "want a pentest" first need a vulnerability scan and a half-day conversation about architecture. The pentest of a specific asset comes after that.
When a pentest is worth it
A penetration test is worth the money when three conditions hold at the same time:
- You've done the basics. MFA on every account with admin access, EDR on every endpoint, 3-2-1 backups with a restore test, patches on a cadence, passwords in a manager, network segmentation between the office and the server room. Without those, a pentest will only confirm what you already know.
- You know what you're testing. A specific application (B2B portal, shop, customer portal), a specific piece of infrastructure (production environment, a specific network), a specific scenario (attack from the internet, insider from an employee account). "Test our company" isn't a scope.
- You know what you'll do with the result. You have a person or a vendor who will take the report, prioritize and fix. If nothing changes after the report, that was an expensive toy, not an audit.
An example where a pentest paid for itself. A 30-person logistics company built a B2B portal for their partners — login, order entry, invoice view. Before go-live they ordered an application pentest scoped specifically to that portal. Cost: 22,000 PLN, two weeks of work. Result: two serious authorization bugs (user A could see user B's orders by changing a URL parameter), one SQL injection in the search box, a handful of smaller issues. Fix effort: 40 developer hours. Without the pentest the portal would have gone to production, and according to their lawyer, after the first customer data leak they were looking at a civil case in the six figures plus a report to the data protection authority.
When it's a waste of money
A pentest is money down the drain in a few familiar situations:
- You haven't done the basics. If MFA lives only on the CEO's account, the last backup restore test was two years ago and the printer still has its default password — a pentest will tell you that for 20,000 PLN. For the same money you can put EDR on 30 stations for two years, do basic segmentation and deploy a password manager. You'll be actually more secure instead of paying to be told you aren't.
- The scope is "the whole company". With no defined target the pentester will spread thin. They'll find easy things and miss hard ones. You pay for a wide, shallow report instead of a narrow, deep one.
- You have no one to fix things. We saw a 12-person trading firm receive a report with 47 findings. No IT team, no plan, no repair budget. A year later they ordered another pentest — the same 47 findings, plus a year. The owner had "annual security audit" ticked on the insurer's list. Nothing changed except the company bank balance.
- You're doing it "because the customer requires it" and no one verifies. Then what you need is a cheap vulnerability scan and a signature on the questionnaire, not a real pentest. That's not fraud — it's common sense. If the customer wants a certificate, buy a certificate. If the customer wants a real result, buy a real test.
The anti-hype version is simple: a pentest is nobody's first step in security. It's the check that the first few steps were done right.
How to pick a vendor
The market splits into two extremes: garage "hackers" selling a pentest for 4,000 PLN (and you get a Nikto report), and big audit firms selling OSSTMM methodology for 60,000 PLN and sending a junior for two days. The middle — good specialists with a clear scope — exists, but you have to look.
- Ask for a redacted sample report. A good report has step-by-step reproduction, impact assessment, a concrete fix recommendation. If what you get is "a list of vulnerabilities" with no context — that's a scanner, not a pentest.
- Ask who exactly will be testing. Name, certifications (OSCP, CRT, GPEN), experience. Not "our team".
- Put the scope in writing. Specific IPs, specific domains, specific applications, specific hours. Anything outside that is outside the contract.
- Agree on a retest after fixes. In the price or with a small top-up. Without a retest you don't know whether the fix actually closed the hole.
What happens after the report
The report is the beginning, not the end. Open it the day it lands and split findings into three buckets: "fix this week" (critical, exploitable from the internet), "fix this quarter" (serious but need bigger changes), "risk accepted" (a conscious decision, written down with reasoning). Keep that split in a file, not in your head.
Three months later, retest. A year later, decide whether you actually need another full pentest or whether a scan plus a targeted test of what changed will do. Not every year needs the same scope.
If you're not sure whether your company is ready for a pentest or should first sort out the basics — half an hour of conversation should be enough to decide. No 20,000 PLN quote required to open the door.
A pentest is not the first step in security. It's the check that the first few steps were done right.