How do you choose a penetration testing company?
To choose a penetration testing company, compare providers on six things: tester qualifications, methodology, depth of manual testing, report quality, compliance fit and how they handle scope and communication. Ask for a redacted sample report, named testers and written rules of engagement before you sign, and compare value delivered rather than the lowest quote.
Knowing how to choose a penetration testing company matters because two proposals with the same scope can produce very different results. One may deliver a senior-led test that finds a chained path to customer data. The other may deliver lightly edited scanner output. The difference rarely shows in the quote; it shows in the report.
What are the steps to choose a penetration testing provider?
- Define the objective. Audit evidence, a pre-launch check, customer due diligence or a real-world risk picture. The objective decides the scope and depth you need.
- List what is in scope. External and internal networks, applications, APIs, wireless, people. Note any systems that must not be disrupted.
- Build a shortlist. Look for firms with testing experience in your environment and industry, recognized accreditations and references you can call.
- Send the same scope to every provider. Comparable proposals are the only way to compare value.
- Score the proposals. Use the scorecard later in this guide, weighting tester quality and report quality highest.
- Review a sample report and meet the testers. Ask who will actually test your environment and how they communicate critical findings.
- Agree terms before testing starts. Written authorization, rules of engagement, NDA, data handling, insurance and how retesting works.
What qualifications should a penetration testing company have?
A qualified penetration testing company has experienced testers with recognized hands-on certifications, such as OSCP, GPEN or CREST, and a documented methodology based on public standards. At the firm level, look for accreditations, industry experience, professional insurance and clear data handling. Certifications show baseline skill; references and sample reports show real quality.
| Credential | Issued by | What it shows |
|---|---|---|
| OSCP (OffSec Certified Professional) | OffSec | Passed a hands-on, time-limited exploitation exam |
| OSEP, OSWE, OSCE3 | OffSec | Advanced evasion, web exploitation or combined expert level |
| GPEN, GWAPT, GXPN | GIAC (SANS) | Network, web application and advanced exploitation knowledge |
| CREST CRT, CCT | CREST | Registered and chartered tester exams; CREST also accredits firms |
| CISSP | ISC2 | Broad security management knowledge; not a hands-on testing credential |
Canary Trap requires OSCP or an equivalent certification and at least five years of hands-on penetration testing experience for its testers.
What methodology should a penetration testing company follow?
A penetration testing company should follow a documented methodology based on public standards, most commonly NIST SP 800-115 for the overall process and the OWASP Web Security Testing Guide for applications. Other recognized frameworks include PTES, OSSTMM and MITRE ATT&CK. A provider that cannot show its methodology in writing is a red flag.
PCI DSS goes further: Requirement 11.4.1 requires a defined penetration testing methodology based on industry-accepted approaches. Ask each provider which frameworks they follow, such as NIST SP 800-115 and the OWASP Web Security Testing Guide, and how they map test cases to them. [Editor: link the methodology post once published.]
What questions should you ask a penetration testing company?
Ask a penetration testing company who will do the testing, how much is manual, which methodology they follow, what the report contains, how critical findings are escalated mid-test, and how retesting and data handling work. Their answers show whether you are buying senior, human-led testing or a scan with a cover page.
| Area | Question to ask | What a strong answer sounds like |
|---|---|---|
| Team | Who exactly will test our environment? | Named testers, their certifications and experience with similar environments |
| Team | Will testers change during the engagement? | No, or only with notice and approval |
| Method | What share of the work is manual? | Most of it; scanners support testing, not replace it |
| Method | How do you test business logic and access control? | Concrete examples, such as testing each role against each object |
| Scope | How did you size this engagement? | A scoping conversation, not just an IP or page count |
| Communication | What happens if you find a critical issue mid-test? | Immediate escalation to a named contact, before the report |
| Reporting | Can we see a redacted sample report? | Yes, with an executive summary, evidence and reproduction steps |
| Reporting | Will the report satisfy our auditor? | Findings mapped to the frameworks you report against |
| Remediation | How does retesting work? | A defined retest process and window, stated in the proposal |
| Security | How do you store and delete our data and findings? | Encrypted storage, limited access and deletion on a set schedule |
| Legal | What authorization and insurance do you require? | Written authorization, rules of engagement and professional liability coverage |
What should a penetration test report include?
A report auditors and engineers can both use includes:
- An executive summary for leadership: overall risk, themes and priorities.
- Scope, dates, methodology and any limitations.
- Each finding with severity (usually CVSS), affected assets, evidence and reproduction steps.
- Specific remediation guidance per finding.
- Root-cause and strategic recommendations.
- Optionally, an attestation letter you can share with customers without exposing the full report.
What are the red flags when choosing a penetration testing company?
The biggest red flags are a quote with no scoping conversation, no named testers, a sample report that looks like scanner output, no written rules of engagement, and findings without evidence. Each one signals that you may be paying for an automated scan rather than a human-led penetration test.
- A fixed quote based only on IP or page counts, sent before anyone asks about your environment.
- Testers who are not named, or who change without notice.
- A sample report that lists scanner plugin IDs without proof of exploitation.
- No written authorization or rules of engagement before testing starts.
- Findings without screenshots, requests and responses, or steps to reproduce.
- No answer to “what happens if you find something critical mid-test?”
- A promise to find “every vulnerability.” No test can do that.
What do you lose with a low-cost penetration test?
A low-cost penetration test usually saves money by cutting manual testing time, using junior testers or delivering mostly automated findings. You lose business logic and access control testing, chained attack paths, useful remediation guidance and, often, a report your auditor or customer will accept. Compare scope, tester seniority and report quality, not price alone.
| What you are buying | Low-cost test | Value-focused test |
|---|---|---|
| Testing approach | Mostly automated scanning | Human-led testing supported by tools |
| Tester seniority | Often junior or unnamed | Named, certified, experienced testers |
| Business logic and access control | Rarely tested | Tested role by role and object by object |
| Chained attack paths | Not explored | Explored to show real impact |
| Report | Scanner output with severity labels | Evidence, reproduction steps and fixes |
| Audit acceptance | May be questioned | Built for auditor and customer review |
Cost follows effort, and effort follows scope. The main cost drivers are the number and complexity of targets, the test type, the depth of testing, reporting needs and testing windows.
How do you compare penetration testing proposals?
Compare penetration testing proposals with a weighted scorecard. Score each provider from 1 to 5 on tester qualifications, report quality, methodology, manual depth, compliance fit, communication, and data handling, then multiply by the weight. The highest total, not the lowest price, shows the best value.
| Criterion | Weight | Provider A (1–5) | Provider B (1–5) | Provider C (1–5) |
|---|---|---|---|---|
| Tester qualifications and experience | 20% | |||
| Report quality (sample report) | 20% | |||
| Methodology (documented, standards-based) | 15% | |||
| Manual testing depth | 15% | |||
| Compliance fit (framework mapping) | 10% | |||
| Communication and escalation | 10% | |||
| Data handling, legal and insurance | 10% | |||
| Weighted total | 100% |
Adjust the weights to your objective. If the test is mainly for SOC 2 or PCI DSS evidence, raise compliance fit. If you need to know your real-world risk, raise manual depth.
Frequently asked questions about choosing a penetration testing company
Should you rotate penetration testing providers?
Rotation brings fresh eyes, but switching every year loses context and makes results harder to compare. A common middle ground is keeping a provider for two to three years while asking them to rotate testers, then re-evaluating the market.
Is CREST accreditation required?
Not by most frameworks, but some buyers and regulators prefer or require accredited firms. FedRAMP penetration tests must be performed by an accredited third-party assessment organization (3PAO), and DORA sets requirements for threat-led penetration testers. You can check a firm’s status on the CREST website.
Should you choose a penetration testing company, a bug bounty or PTaaS?
A penetration testing company delivers scoped, documented testing auditors accept. A bug bounty pays per valid finding and gives broad but uneven coverage. Penetration Testing as a Service delivers recurring, human-led testing aligned to release cycles. Many programs combine a scoped test with one of the other two.
Can the company that tests you also fix the findings?
It can advise on fixes, and good providers give clear remediation guidance. For independence, the team that implements major fixes should not be the only team that validates them. PCI DSS requires testers to be qualified and organizationally independent of the systems they test.
How far ahead should you book a penetration test?
Book several weeks before any audit or launch deadline. That leaves time for scoping, testing, reporting and fixing critical findings before the evidence is due.
Does the provider need to be in your country?
Not for most remote testing. Location matters for on-site work such as wireless testing, for data residency requirements, and when regulators or customers require local providers.
Talk to Canary Trap
Canary Trap has delivered penetration testing since 2020, with named, certified testers and methodology grounded in NIST SP 800-115 and OWASP. If you are comparing providers, talk to our team and ask us the questions in this guide.
