We are a company that has many web applications developed in ASP.NET. Our Internet service provider (Telefonica) wants to test our web sites looking for vulnerabilities. For that, they are asking us to provide them credentials (read-only access) for each web site.
It's the first time that I have heard that for testing vulnerabilities in websites you need to provide such information to an ISP. I always thought that for testing vulnerabilities you should try to break or hack websites without knowing that precious info? Maybe I'm wrong.
Finally, I know what kind of vulnerabilities testing are they going to perform. They are going to use Qualys Guard Scan and perform "authenticated scans". First time I've heard about that. According to Qualys company, they are very helpful to find security vulnerabilities:
Any experience with that kind of scans?