We are a small company (< 20 ppl), have developed a fairly complex backend platform that exposes a web services API and we are currently productizing a SaaS-based offering that is a client to the backend. Both the backend and the SaaS-based offering are being marketed to enterprise prospects.

We adhere to security best practices but obviously we need independent verification and scrutiny if we are going to satisfy some of these large prospects. Eventually we will probably adopt some framework (COBIT, ISO 27001, etc.) once we can make some additional hires, segregate duties, etc. but for now we would like to improve our SDLC and submit our web applications to third-party penetration testing.

We have been trying to avoid the big accounting firms and big technology vendors (e.g. IBM) in the belief that they will be expensive and not in very good alignment with our organization. I guess I would call these "Tier I" consultants for lack of a better term.

We have tried what I'd guess I would call a "Tier II" firm (i.e. their personnel have come from a Tier I firm and provide similar services but are more affordable) but their experience seemed highly influenced by servicing companies seeking SOX compliance, etc. and the approach didn't seem like it was in good alignment with our need to prioritize our security expenditure.

I have tried to get in touch with other Tier II consultants but they seem to have their own issues (i.e. personnel leaving, don't get back to me in a timely fashion, don't really probe to see how they can best service our needs, etc.).

I am a bit reluctant to seek a sole proprietor or smallish company (call this Tier III I guess) as we want to leverage a name a little bit if we can and partner with someone that can provide some continuity of service and resources in a timely manner. No, "Sorry, I'm fully engaged right now, call me back in a month."

Which leads me to my conundrum/question: What kind of Security Consultant would you recommend for a small company that: 1) has a fairly complex web application; 2) markets its products and services towards enterprise prospects; and 3) needs to prioritize its security expenditure?

I should also state that I was trying to find someone with feet on the street in my neck of the woods so that we could meet face-to-face. I'm wondering how important a factor you think that is for this type of engagement.


  • @Jason: Shopping recommendations are pretty well considered off-limits for Stack Exchange sites as a whole. Check out this blog post about the issue and recommendations on how it could be adapted to an answerable question: blog.stackoverflow.com/2010/11/qa-is-hard-lets-go-shopping
    – Scott Pack
    Jun 27, 2011 at 20:51
  • I'll get around trying to come up with something more generic later tonight. I work at a tier II CPA and would be happy to assist. You can Google me to find my Linked In profile.
    – Jeff Ferland
    Jun 27, 2011 at 20:51
  • 1
    @Scott - I don't think this really falls into a shopping question. At first I commented that the question would likely be closed, but after further reflection, there is a framework of different types of companies that are more suitable to a small software shop. Some tier-II CPA firms can cover that. There are also boutique shops. This is very different than comparing models of laptops that will be irrelevant next year.
    – Jeff Ferland
    Jun 27, 2011 at 20:53
  • 2
    I think "your neck of the woods" (which you don't even define in the question) makes this too localised. To be honest, I'm still finding it hard to understand how this is anything other than a shopping question (especially if people are replying with offers to sell you things... ¬.¬)
    – user185
    Jun 27, 2011 at 21:04
  • 1
    @Graham Lee, I'm not asking for specific vendors in responses. I'm asking for guidance as to what type of Security Consultant would be in good alignment with an organization our size and the challenges that we have (marketing to enterprise customers, affordable). That's why I went to the (crude) effort of typing the kinds of consultants. Like maybe someone will suggest a Type III consultant has worked well for them to get them on the path and then they engaged a Type II or Type I consultant... that sort of thing.
    – Jason
    Jun 27, 2011 at 21:11

3 Answers 3


Not mentioned, but exceedingly valuable - references:

Do you have other companies in your industry you could talk to to find out who they use, and how satisfied they are with the service?

I understand if you are in a specific niche, this might mean going to competitors to ask their opinion, but there is a very good argument which says that companies should pull together to secure their industry, and I believe that joining forces to share security best practices and information should not be a competitive distinction (unless you are in the security industry) but should help you both.


Here's some background on the players:

  • CPA firms. Financial-world focused, they deal with CFOs and regulatory questions. Typically less technical in exchange for more business knowledge and being able to sign off on assurance engagements. Depending on the field you're in, other companies might not play with you if you don't have a letter from one of these. Because of their basic financial assurance, they are also found playing strong in other assurance fields like HIPAA.

    • The big 4 (down from 8) KPMG, Ernst & Young, PwC, Deloitte Touche. They all have specialist departments focused on IT. Their strength is in great depth and they can call up from around the world. Big doesn't necessarily mean better -- it's a price trade-off. you're paying extra for the insurance of somebody who "cannot fail". I've seen some signs otherwise, but maybe that's personal bitterness: http://www.healthcareitnews.com/news/maine-inks-179m-deal-medicaid-management Go here if your company is so large that you need more than 10 staff to get through your engagement.
    • The regional players: There are many, and they're filled with people who will go to the big firms or who came from them. Since Sarbanes-Oxley's independence rules, they get a bigger share of the pie. I work for one of the regional players, and regionals play in the Fortune 500 game. Go here if you're looking for expertise at a lower cost than a Big-5 and won't need enough feet on the ground to trample you. Beware that not all of them have deep technical knowledge. Most of them should have appropriate connections to other firms for specific parts of projects. (Say you're in Seattle - I might show up there once or twice, but if I need a lot of hands-on I might send somebody from another firm as part of a network). Shameless promotional pitch: http://bnncpa.com/
  • Boutique firms Specifically dedicated to IT, they may be useful for better internal development. Some industries will take assurances from a boutique as an outside vendor.

    • National / International firms Sourcefire, Rapid7 and IOActive fall into this category. They're probably closer in staffing to a larger regional CPA firm. Their customers are technology companies or suitably large IT departments.
    • Local players The rest of the world fills out this. Smaller shops that cover a specific region and have a more narrow field of experience. Their people probably are more generalized in their experience.

One really good way to get an idea of what's in your area is to take a look at your regional conferences for ISACA. In my case, http://www.isacane.org/events_detail.php?select=257 has a list of players form all of the above categories except the regional CPAs (boy, somebody dropped the ball there?). Besides that, you might also find actual specific recommendations if you poke around this site's chat room.

  • Thanks for your post. "Some industries will take assurances from a boutique as an outside vendor." This is the kind of thing I am trying to get some visibility into. How can I find out this sort of thing? If I had some answers to questions like these the arrows might point me to a CPA firm. Like would a SOX compliant enterprise customer consider assurance from a boutique firm? I'm guessing they are highly skewed towards CPA assurance because the assurance is more likely to be comprehensive (i.e. include organizational risk).
    – Jason
    Jun 27, 2011 at 22:30
  • 1
    Hi @Jeff - from much experience I can say the cost implications of the Big-4 may actually be opposite to that which you expect. They can hire very good people, and can use their size to reduce costs in many cases. For example, I used to have one of the biggest penetration testing teams in the world, and was able to come in at a better price than competitors because I could use the scale of my team to resource across borders where necessary.
    – Rory Alsop
    Jun 28, 2011 at 7:50

Contact an industry analyst group, such as Forrester or The 451 Group. I used to also like The Burton Group, but they were acquired by Gartner. I like Gartner, but it's good to get a balanced/neutral view and I think they (like the other large organizations) become more narrow-minded towards products from major vendors.

A similar thing exists between OWASP and WASC. OWASP provides balanced/neutral advice, while WASC is an organization that is focused on providing product-specific advice for the vendor companies that support it. OWASP has company members/sponsors, but they do not comment on which sponsors are better or more quality than any others.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .