Practice note
What belongs in a penetration test quote
If the quote does not name the surface, the rules of engagement, and a retest, you are shopping a scan. Scans are useful. They are not a test.
Prime-Tek external tests are quoted with a cap (typically 15 public IPs), exploitable findings, and a retest window. Web applications are a separate GWAPT-scoped SKU. GIAC GPEN and GWAPT sit next to the work, not in an About footer.