I have both done pentests and received pentest reports. My observation is that the perceived severity often varies between the tester and the customer.

  • cronOP
    link
    fedilink
    arrow-up
    7
    ·
    3 months ago

    Thanks for sharing your insight!

    I really like this aspect where you say that the business determines the risk, not the tester. I think this is an easy pitfall, especially for people with less experience than you ;)

    • mosiacmango@lemm.ee
      link
      fedilink
      arrow-up
      5
      ·
      edit-2
      3 months ago

      Sometimes the law determines the risk. Any critical/highs in PCI will get you speed bagged, so you sort those either way.

      Now, sometimes the sorting is “turn if off for the retest” which is just the business ignoring risk in a complicated way, but it still gets addressed in some way.