How is something like this not picked up in a pen test? Can only assume there never has been..

so many "pentests" are:

* run scanner

* print out report

not a lot of deep diving

Yep. It's a shame. I once (long ago :)) alerted our CTO to an ongoing attack in production after seeing some obviously attack-oriented requests coming in and hitting our gateway. It became a pretty high-visibility incident for about 20 minutes until a manager spoke up that his "pen test" was being performed. Looking into the "testing" that was occurring they were attempting to scan for decade-old PHP bugs in a set of services which were written in Java and NodeJS. Very high value stuff... Can only imagine what the invoice was for this valuable service.

nicholasjarnold

So, to try and add some value to this conversation vs just reporting a personal anecdote... Do people here have suggestions for actually-good white-hat companies?

Can you recommend companies that you've personally worked with who employ knowledgeable security engineers (hackers) to perform real penetration tests and conduct valuable security scans resulting in value-add reports your engineering team can work with?

Not looking for naming and shaming...but rather "Who doesn't suck at doing this?".

photon12

NCC Group is probably the biggest name because they go around Hoovering up companies that are usually above average in the competencies you asked about. And they can attract and retain talent.

Trail of Bits is another big name because they hire and retain talent across a large number of enterprise, emerging tech, and research verticals.

Other established firms include Atredis Partners, IOActive, Security Innovation. There are more one could list.

Sometimes these companies work with partners who ask to publicly disclose some artifact resulting from the test. Here is a collection of those reports aggregated by firm: https://github.com/juliocesarfort/public-pentesting-reports (Edit: note this is not a great way to evaluate any particular company, but it does provide an objective listing of companies that exist in the pentesting space).

Each firm will also have variability in their personnel for your project which can yield different results for two independent tests on the same target from the same firm.