What this guide helps you evaluate
Security teams budgeting and selecting an authorized penetration test provider.
This page is designed to help you compare the moving parts, organize due diligence and ask better questions before you commit money, sign a contract or change an operating process.
What to compare first
- Number and complexity of web apps, APIs, external hosts and cloud environments
- Authenticated versus unauthenticated testing
- Source-code review, social engineering or wireless scope
- Retest and remediation validation
- Tester experience, methodology, reporting quality and independence
Step-by-step process
- 01
Define in-scope systems, test accounts, exclusions and business blackout periods.
- 02
State whether the purpose is risk reduction, customer assurance or a specific compliance requirement.
- 03
Ask vendors to quote the same scope and assumptions.
- 04
Review sample reports for evidence, prioritization and remediation detail.
- 05
Include a retest and rules-of-engagement process in the statement of work.
Common mistakes and risk checks
- Choosing only by day rate.
- Allowing production testing without agreed safety controls.
- Treating an automated vulnerability scan as equivalent to a penetration test.