Choosing a Pentest Partner: Key Questions

Penetration testing is not a commodity service, even though procurement processes sometimes treat it like one. Two firms quoting the same price for what looks like the same scope can deliver very different levels of rigor, and the differences are rarely visible until the engagement is already underway.

How is scope actually enforced, not just documented?

Every reputable firm will produce a Rules of Engagement document. Fewer can explain how every single tool and action during the engagement actually gets checked against that document in real time, rather than trusted to individual testers' memory and discipline. See our piece on why scope enforcement has to be a technical control for what a good answer to this question actually sounds like.

Is exploitation confirmed manually, gated, or fully automated?

Ask specifically what happens between "we found a possible vulnerability" and "we confirmed it." A firm that automates confirmation entirely, with no human review of the specific action about to run, is taking on risk on your behalf that you may not have agreed to. Our piece on human-in-the-loop exploit confirmation covers why this step deserves scrutiny.

Can they show you a real audit trail, not just a final report?

A final report is a summary. The underlying record of exactly what was tested, when, by whom, and with what result, is what you actually want available if a question ever comes up after the engagement ends. Ask whether that record is tamper-evident, not just stored. See tamper-evident audit logs for what that actually means in practice.

Does their reporting map to the framework you actually need?

If you need results that satisfy PCI-DSS, GDPR, or SOC 2 specifically, confirm the report format actually reflects that before the engagement starts, not after you receive a generic report and have to translate it yourself. See mapping findings to compliance frameworks.

Who decides what gets escalated, and how quickly can you reach them?

Confirm there is a real, named contact on both sides for anything unexpected that comes up mid-engagement, not just a support email address. This is a small detail in a proposal document and a genuinely important one the one time you actually need it.

For a broader look at what "the real cost" of getting this wrong looks like, see the real cost of skipping a penetration test.