Penetration testing checklist for Philippine SMBs (before you sign an engagement)

If you run a business in the Philippines with any kind of customer-facing web app, payment flow, or exposed server, you've probably been pitched a 'penetration test' at some point. Prices range from ₱15,000 to ₱600,000 and the deliverables look identical in PDFs. This checklist is what to look for before you sign anything.

1. Scope: what exactly is being tested?

A real engagement has a written scope that lists every in-scope asset: web app URL(s), API endpoints, IP ranges, mobile apps, network segments. If a vendor says 'we'll test your website' without specifying the routes, the report you'll get back will be near-useless.

• Public-facing URLs (with login + without login paths)
• API endpoints (GraphQL, REST) — version paths matter
• Mobile apps (Android package name, iOS bundle ID)
• Network segments (cloud VPC, on-prem IP ranges)
• Out-of-scope explicitly listed — what's NOT tested matters as much

2. Methodology: OWASP or marketing?

For web apps, the test should follow OWASP WSTG (Web Security Testing Guide) or NIST SP 800-115. For mobile, OWASP MASVS / MASTG. Manual + tooling, not just a scanner.

3. Deliverables: what's in the report?

• Executive summary a non-technical owner can read and act on
• Each finding: CVSS score, business impact in plain language, PoC steps, remediation
• A fix patch or specific code/config change recommendation — not just 'update to latest version'
• Free retest after you've remediated (1 cycle at minimum)
• Clear re-test scope and retest deadlines in writing

4. Questions to ask the vendor

1. Who is doing the testing — a junior analyst, the sales engineer, or a senior pentester? Ask to see their CV + certs (OSCP, OSWE, CRTP, CySA+, CEH, etc.).
2. How many findings do you typically produce for an app our size? (If the answer is <5 for a real production app, they're not looking hard.)
3. What's the timeline, and what happens if scope changes mid-engagement? (Get this in writing.)
4. Will you give us the test plan + threat model BEFORE testing starts? (Yes is the right answer.)
5. Can we keep the report confidential? What about data retention?

5. What it should cost

Realistic ranges in PHP for Philippine SMBs, 2026: a single web application (2-4 weeks, manual + tooling + report + retest) lands between ₱180,000 and ₱450,000 depending on auth complexity and number of user roles. Anything priced below ₱80k is almost certainly a scan, not a test. Multi-app or network engagements scale from there.

What we do differently

428AM ships a written test plan before we touch anything, includes a fix patch (not just a finding) for each issue, and gives you a free retest after your team remediates. Timeline is 2-4 weeks; reports are OWASP-aligned; the test team holds CySA+ and CEH. We don't do automated scan-only engagements and we don't pretend they count.

If you're evaluating vendors, send us the scope and we'll send back a written test plan and a fixed quote within 5 business days. No sales call required for the initial scoping.