Gray hat hackers, offering dirt cheap penetration tests for as little as $500, have helped taint the image of professional penetration testers.

In an article which appeared in Computerworld's sister magazine, Chief Security Officer (page 38, July, 2006), Gartner security analyst John Pescatore said hackers, often students, have driven some professional testers out of the business by undercutting prices by more than 80 percent.

However he warns that cheap tests are risky for business because they do not construct exercises that reflect the complexities of a corporate network.

Mark Weatherford, CISO for the state of Colorado said in the same article that business must tighten network security and plug vulnerabilities to get the most out of a penetration test, and to avoid damaging poorly built systems.

"People think that you can push the easy button and it will happen, your problems are clear. It just points out that your system can be exploited. Big deal," Weatherford said.

"I consider a pen test to be the supreme test for a mature organization. It's important to remember that pen tests are invasive and can break things."

Have an opinion on this story? Click to e-mail Darren Pauli.