A common theme in security engineering is that perfect security is impossible (or at least highly unlikely). Consider Johnston's Infinity Maxim:

There are an unlimited number of security vulnerabilities for a given security device, system, or program, most of which will never be discovered (by the good guys or bad guys).

With that in mind, how much sense does it make for penetration tests to be arranged on a "no hack, no fee" basis (analogous to "no win, no fee" legal engagements)? Put another way, does the Infinity Maxim hold true within the scope of real-life pen-testing scenarios? I'm interested in answers from experienced pen-testers, without reference to particular firms.

closed as off-topic by Rory Alsop Apr 24 '14 at 17:45

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • This question appears to be off-topic because it is not actually about security. – Rory Alsop Apr 24 '14 at 17:45
  • As ack pointed out, it is unlikely, but if a company decides to do it they can. It is not on topic here, as that would be solely a business decision. – Rory Alsop Apr 24 '14 at 17:46
  • It's about pen-testing agreements. Pen-testing is considered on-topic, and defining/understanding such agreements is considered an important part of the pen-tester's skill set by at least one established training organisation - not least because doing so effectively requires a good understanding of what pen-testing is/isn't and what it can/can't achieve. Anyhow, I'll re-word my question to explain why it's relevant to underlying security considerations. – sampablokuper Apr 24 '14 at 19:16
  • I agree with @RoryAlsop, this is about a particular sales pitch, not information security. It's also argumentative and hard to answer with facts and references, instead of resorting to speculation (e.g. answers along the lies of: There are some, here's another I found). And there's another concern, that the question might attract lots of spam with no way to nuke it, since it would essentially be answering the question, even if most likely only partially so and with no way to confirm their accuracy (e.g. answer like: We [name, link] can do that, and there's no other like us in [some area]). – TildalWave Apr 24 '14 at 19:48
  • Reworded again, to take into account above comment. – sampablokuper Apr 24 '14 at 20:05

This is simply not a viable business option for security testing companies, as you can never know in advance what you will face during a pentest engagement.

Furthermore, those services are purchased by customers to evaluate the security level of a target application / infrastructure / device / whatever, the actual compromise of the target is only the consequence of a successful assessment, not the main objective.

Not the answer you're looking for? Browse other questions tagged or ask your own question.