How poor client communication erodes pentest margin

Consider a hypothetical fixed-price application test. The quote includes testing time and an allowance for reporting and review. The tester completes the booked testing days, but the engagement also needs an extra half day from a senior consultant. A delivery manager spends two hours resolving a disagreement about the report.

The amounts of effort in this example are illustrative. They show why reviewing only the assigned tester’s time can give an incomplete account of project cost.

The extra work needs to be recorded before the team can decide which part was avoidable.

Where the additional work begins

In this example, the proposal includes testing two user roles. Only one account works when the test starts. The access request named the roles, but nobody confirmed that the accounts had been checked in the test environment.

The tester spends time investigating the failure. The delivery manager contacts the client, and both sides need to agree which work can proceed. Once the second account arrives, the tester revisits a workflow they could only partly assess earlier.

An access failure can happen despite reasonable preparation. Here, the missing confirmation is something the team can address. Assigning responsibility for checking the prerequisites before the start would give the client time to resolve the problem or agree a change to the dates.

The scoping article covers the information needed to make that decision. The commercial consequence in this example is time spent handling a dependency that the price assumed would already be resolved.

The tester records a genuine weakness, but the finding does not identify the permissions of the account used. The reviewer cannot tell whether the behaviour crossed an access boundary, so they return it for clarification.

The tester may need only twenty minutes to correct the paragraph. The reviewer also spends time identifying the omission and checking the revised account against the evidence. If the evidence is unavailable, the team may need access again.

Suppose the report passes through three review cycles instead of the one allowed for in the quote. Record the work done in those cycles, including any senior rewrite. Also record where the report waited for someone to respond. Waiting affects the delivery date, but it should not be counted as labour unless someone was actually working or blocked from assigned work.

OWASP’s reporting guidance describes reports that technical and executive audiences can understand. Applying that guidance during drafting helps reviewers assess the finding without reconstructing the engagement from scattered notes.

The debrief reopens the explanation

The client challenges the severity because the report does not explain a condition required for exploitation. A senior consultant joins another call and reviews the finding with the tester. This is where the illustrative extra half day could be spent, including preparation and amendments.

The client may have useful information, and some follow-up is part of the service. The cost becomes avoidable where the report omitted information already known during testing, or where nobody recorded an earlier decision.

Keep those causes separate. A client supplying new information needs an evidence review. A tester unable to explain a conclusion may need coaching. A request for additional test coverage needs a scope decision. Counting all of them as poor communication would obscure the response required.

Account for the whole engagement

Use the project record to bring the extra work together. Include support given informally by senior testers and work done after report issue. Apply the business’s normal cost assumptions consistently when assessing margin.

Additional work	Record needed
Access clarification	Time spent, dependency missing and when it became known
QA correction	Material defect, correction time and reviewer effort
Client discussion	Reason for the discussion and whether it changed the assessment
Work beyond the agreed scope	The request, approval and any agreed fee or schedule change

Avoid counting the same work under several categories. The purpose is to understand the engagement’s actual effort and which decisions created it.

An extra half day has a cost even if the client never receives an additional invoice. Whether that changes the commercial decision depends on the agreement and the account. The business may choose to absorb some work, but it needs to know what it has agreed to absorb.

Change the point that caused the repeated cost

Review a sample of completed engagements before choosing a response. If missing access repeatedly creates additional setup work, improve the readiness check. If reports repeatedly omit preconditions, use those defects in drafting guidance and coaching.

After making a change, compare the relevant work on later engagements. Read the figures alongside differences in scope and complexity. The team performance framework defines measures for unplanned recovery work and senior intervention that can support this review.

For the illustrative project, the first changes would be an explicit account check before testing and a report check for access conditions. The next project record should show whether those changes reduced the additional work, including the time spent by people who were never assigned as its tester.