Subcontracting a Test and Keeping the Report Yours

When you subcontract a penetration test, keep the report yours by agreeing in advance where the data lives, whose findings library and template the outside tester uses, who owns the findings and whether the client's authorisation covers them, then review every finding before it ships under your name. The testing is the easy part to arrange; the report is where it goes wrong.

Every consultancy subcontracts eventually: a hardware job, a language nobody in-house reads, two engagements landing in the same week. What follows is how to do it without losing control of your own deliverable.

The client is buying your name

Start from that. The client signed with you, the letterhead is yours, and the liability follows the letterhead. Whatever arrangement you make behind it, the document that goes out has to be yours in substance as well as branding: your severity scale, your house language, your quality bar.

That is not a formality. An outside tester’s critical may be your high. Their evidence standard may be a screenshot where yours is a request and response pair. Shipping their judgement under your name means you will defend it on a call you are not prepared for.

What to agree before they start

• Where the data lives. If they work in their own tooling, your client’s vulnerabilities are now on a third system your client has never been told about. Either bring them into yours or tell the client, and the first is easier than the second.
• What happens to it afterwards. A deletion commitment with a date, in the contract, not an assurance on a call.
• Whose findings library. If they write from their own boilerplate the report reads as two documents. Give them yours, and the house wording in a findings library your team actually uses becomes theirs for the fortnight.
• Attribution. Whether the client is told an outside tester was used. Say yes. Finding out later is worse than being told, and some frameworks require it.
• Right to test. Your authorisation from the client has to cover them by name or by category, or their traffic is unauthorised regardless of what you agreed with them.

This is not legal advice: have a solicitor review the terms you use with outside testers, particularly on ownership, deletion and who the client has authorised to test.

Access, and the mistake everybody makes once

The tempting arrangement is to give them a login to your tooling and sort out the details later. The details are: which clients can they see, which engagements, and can they read the knowledge base you spent three years building.

The answer should be the narrowest access that lets them do the job, granted for the engagement and removed on the last day. If your tooling cannot give you that, the outside tester works in a shared document and you paste the results in, which is worse in every way except the one that matters, so most firms should fix the tooling.

Review is not optional and it is not a read-through

Somebody of yours reviews every finding: the rating, the evidence, the remediation and whether it is reproducible from what is written. That is the same review you would do on a junior’s work, and for the same reason, and it belongs in a QA process that survives a busy month rather than in a favour at the end. Budget for it when you price the job, because a fortnight of subcontracted testing is not a fortnight of your cost.

Where the review disagrees with the outside tester, your rating wins, and the conversation about why happens with them rather than in the document. A report carrying two voices arguing is a report that loses an argument with a client.

When they find something critical

Decide this before day one, because the default instinct of a capable tester is to ring whoever is in front of them. The client relationship is yours, so the outside tester tells you first, immediately, against the same threshold your own testers use, and your firm makes the call to the client. Two firms phoning one client about one finding, with slightly different descriptions of it, is the fastest way to make a specialist job look disorganised.

Give them the escalation route in writing: who to call at your firm, a second name if the first does not answer, and what to send afterwards. The rest of the routine is set out in finding something critical mid-engagement, and it applies to them exactly as it applies to you.

What the client is told, and when

The instinct is to keep it quiet, and it is the wrong instinct in both directions. Clients who find out afterwards conclude you were hiding it, which is a much larger problem than the subcontracting was. Clients told at the point of scoping almost always shrug, because using a specialist for a specialist job is what they would want you to do.

Tell them what the person is being brought in for, that they are covered by the same confidentiality terms, and that the work is reviewed by you before it reaches them. Do not name the individual unless the client asks or the authorisation requires it, because naming invites a conversation about their CV that is not the point.

There is one case where the answer is different. If the client is in a regulated sector, or runs a supplier assurance process, subcontracting may need approval rather than notification, and the approval may take longer than your engagement lead time. That is a scoping question and it belongs in the first call, not in the week you realise you need help.

The commercial shape

Day rate, fixed fee or a share is a decision about who carries the overrun. Day rate puts it on you, fixed fee on them, and a share on both. For a specialist you have not worked with, fixed fee with a clearly bounded scope is the least painful first arrangement, and it forces the scoping conversation to be real.

Whatever you agree, price your review into the client quote rather than absorbing it. The margin on subcontracted work is thinner than it looks, and the review is the part firms forget to count.