Home / Knowledge hub / Choosing a pentest provider
Knowledge hub
Choosing a pentest provider
What to ask, check and compare before hiring a firm to test your software.
What it means
Choosing a pentest provider means deciding who you will trust to test your software and report honestly on it. A test is only as useful as its scope, method and evidence. Price and a logo on the website tell you little about whether the work will find your real problems.
Start with what you need. A compliance test for an audit, a deep review before a launch, and routine checks after each release are different jobs. Know which one you are buying, then compare providers on how they would do that job for your application.
Why it matters
A weak test is worse than none, because it gives false comfort. A short scan relabelled as a test, a report padded with unverified findings, or a scope that skips the API behind your mobile app can all pass a purchasing review and miss the flaw that matters.
Buyers also ask about it. Enterprise customers and auditors look at who tested you, how, and whether fixes were checked. A report from a clearly competent provider carries weight in a security questionnaire. A vague one raises more questions than it answers.
How it shows up
Ask for a sample report. Look for reproduction steps, evidence for each finding, severity that is explained, and a clear separation between severity and confidence. Ask how they handle scope, whether they test business logic and authenticated areas, and who actually does the work.
Then ask about the end of the job. Do they retest fixes, and is it included? How is your data stored and who can see it? Are there written rules of engagement? Is the report acceptable for the audit you have? Accreditation bodies such as CREST can help, though they are not the only signal.
Questions people ask
Choosing a pentest provider, answered
What should I ask a pentest provider?
Ask for a sample report, the method they follow, who does the testing, how they treat business logic, what the retest policy is and how they store your data.
Also ask which findings they would not report.
Is the cheapest quote a red flag?
Not always, but very low prices often mean a scan with a short human review. Ask what hours, tools and manual work the price includes, and compare like for like.
Scope matters more than the total.
Do we need a certified tester?
Some audits and buyers ask for recognised qualifications or an accredited firm. Check what yours expects. Certifications show some knowledge, while sample work shows how the person tests.
Ask for both if you can.
Should the provider test the code or only the running app?
It depends on the goal. Black-box tests resemble an outsider, grey-box tests use a signed-in account, and white-box tests also read the code. Pick the mode that matches the risk and budget.
Ask which modes they offer.
How do we know the findings are real?
Look for evidence in the report: the request, the response, steps to reproduce and a screenshot where one helps. A finding the provider cannot demonstrate is a claim, not a result.
Ask for the retest evidence too.
Related
Terms that sit next to this one
Penetration test cost
What drives the price of a pentest: scope, depth, time and who does the work.
Penetration test report
The document that lists what was found, how, how bad it is and how to fix it.
Penetration test scope
The written list of what a pentest may and may not touch.
Retest
Running the test again to confirm that a reported flaw has really been fixed.
Manual penetration testing
Testing led by a person's judgement, not just by running an automated scanner.
Can the provider prove each finding?
We find vulnerabilities in web apps and APIs with black-box, grey-box and white-box testing, and report only what we exploited. Each finding carries the request and response, and fixes are retested. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.