I am planning to launch a pen test company and several questions have arisen (e.g what NIST documents should I study, how to properly report vulnerabilities to clients and more).

I would like to ask those as separate questions on info security, but I am not sure if it is the right place.

Hence, I am asking here first.

| |
  • 4
    It sounds like your questions will be opinion-based and specific to your locale and your customer needs. – schroeder Oct 4 at 6:59
  • 2
    I agree with @schroeder and the answer below, but I will add one bit of advice: most of this you should already know BEFORE opening a company. Go get a job working for an existing company and learn all that stuff, and then open your company after you already know how to do the work. You'll still need to learn a ton about running a company, but at least the professional/pentesting part you will be an expert. Good luck. – AviD Oct 8 at 7:38

To me, it sounds like your questions are to broad and maybe to dependent upon your specific situation to be answered in a good way. What NIST-documents should you study? It depends on what you want to learn. How do you report a vulnerability? It depends on the vulnerability and your relation to the vulnerable party.

That said, if you have something a bit more specific you are welcome to ask. Questions may be closed if they don't fit in, though. Good luck with your company!

| |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .