Choosing a Penetration Testing Provider: Questions to Ask

Choose a penetration testing provider on the answers to specific questions rather than on logos and certifications: who will actually do the work, what they do when they find something critical on day two, what the report and retest include, and where your findings will live. Every firm in this market says the same things on its website, and most of the questions that separate them take under a minute to ask.

Ask who is actually doing the work

Not the company, the person. Ask for the name and background of the tester assigned, and whether the person who wrote the quote is the person who will run the test. In firms of any size these are frequently different people, and it is not a scandal, but you should know.

Follow it with: who writes the report? On some engagements the testing and the writing are split, and the report reads like it. A good answer names one person and explains who reviews them.

Ask what happens on day two

"If you find something critical on the second day of a five-day test, what do you do?" The answer you want is that they stop and tell you, with a named contact and a phone number agreed in advance, as set out in finding something critical mid-engagement. The answer you do not want is that it will be in the report.

Ask about the report and the retest before you buy

• Can you see a redacted sample? Any firm that cannot produce one has a reason.
• Is the reproduction section written so a developer can follow it without calling you?
• Do findings state what was not tested?
• Do you get a machine-readable version as well as the PDF, or only a document?
• Whose logo is on it? For a reseller or an MSP passing this to a customer, that is a commercial question as much as an aesthetic one.

Then the retest. Is it included? How long after the test is it valid? Does it cover everything or only the highest severities? Does it involve exploiting again or only inspecting the change? Those produce different levels of assurance and firms differ on all four, so the answers are genuinely comparative. How to run a retest properly explains why the last question matters most.

Ask where your findings will live

This is the question buyers ask least and should ask most. Your vulnerabilities, written down, in one place, is exactly the document an attacker would most like. Ask:

• What platform holds them, and who else is on it?
• How long are they kept, and can you ask for deletion?
• Who at the firm can read them, and is that restricted to the engagement team?
• If AI is used in drafting, whose model, and does your data leave the firm to reach it?
• How is the report delivered, and is it ever emailed as an attachment?

Certifications: what they do and do not tell you

Individual certifications tell you somebody passed an examination, which is a real signal about baseline competence and a weak one about judgement. Company-level schemes tell you the firm has a process and has been assessed against it, which matters more for consistency than for the ability of the person who turns up.

For UK buyers, scheme membership is sometimes a hard requirement of a framework or a customer contract, in which case the question answers itself, and CHECK or CREST covers which scheme applies where. Where it is not required, treat it as one input rather than the decision.

Ask how they scope, and watch what they ask you

The scoping call is the best signal available and it is free. A firm that asks how many user roles there are, whether the application changes state, how much is bespoke, what it integrates with and whether an API is separately in scope is estimating. A firm that asks for a URL and sends a number is guessing, and the guess will be wrong in whichever direction suits them.

Notice also whether they push back. A provider who accepts an obviously optimistic scope without comment has decided the overrun is your problem, and you will meet that decision again on the last day.

What to check on the paperwork

• Insurance. Professional indemnity at a level that means something relative to the systems being touched.
• Outside testers. Whether they may bring in an associate or freelance tester, whether you are told, and whether the same confidentiality terms follow.
• Ownership of the findings. Not the report, the findings. Some firms treat write-ups as reusable inventory.
• Deletion. A commitment with a date, in the contract, rather than an assurance on a call.
• Right to test. Confirmation they will not begin without written authorisation from somebody who can give it.

Ask for a reference in your own sector

Not a logo on a page. A conversation with somebody who bought the same kind of test on the same kind of system. Ask them one question: what did the report miss? People who have lived with a report for a year know the answer, and it is more informative than anything on a capability statement.

The questions on one page

Question	A good answer	A warning sign
Who tests and who writes?	A named tester, a named reviewer	"Our team"
Critical on day two?	A call the same day to a contact agreed in advance	"It will be in the report"
Accounts and roles?	Two accounts per role, requested at scoping	"We can test without them"
The retest?	Scope, validity period and method stated	"Included", and nothing more
Where do findings live?	A named platform, retention period and deletion process	Silence, or "secure cloud storage"