Two pen test quotes for the same scope can differ by a factor of three, and so can the quality of what you get back. Some providers send a senior tester who finds the attack path into your client data. Others run a scanner, reformat the output and call it a pen test. These ten questions help you tell the difference before you sign.
1. Who will actually do the testing?
Ask for the name, experience and certifications of the tester, not the company's headline credentials. "Our team holds OSCP and CREST" means little if a junior does your test.
2. How much of the testing is manual?
Automated tools are a starting point. The value comes from manual verification, business logic testing and chaining findings together. Ask what proportion of the time is hands-on.
3. Can I see a sample report?
The report is what you're buying. Look for a clear executive summary, evidence for each finding, realistic risk ratings, specific remediation advice and attack narratives, not just a table of CVEs.
4. How do you rate risk?
CVSS alone isn't enough. A medium-rated issue that opens a path to client data matters more than an isolated "high" on a test server. Good providers explain risk in the context of your business.
5. Will you test authenticated?
For applications, most serious issues sit behind login. Make sure the scope includes testing with accounts for each user role.
6. What does the price include?
Check for a fixed price, the number of days, reporting time, a debrief call and a retest. Low day rates often mean less manual work or extra charges later.
7. Is a retest included?
Fixing a vulnerability incorrectly is common. A retest confirms the fixes work and gives you clean evidence for auditors and clients.
8. How do you handle critical findings during the test?
You shouldn't learn about an exploitable critical three weeks later in a PDF. Ask how and when urgent issues are reported.
9. How do you protect our data?
Testers handle credentials, findings and sometimes sensitive data. Ask about secure report delivery, data retention, encrypted storage and whether the provider holds Cyber Essentials or similar.
10. Do you understand our sector?
A tester who knows how financial services, payments or regulated firms work will test the workflows that matter and write findings your risk team can use.
A note on accreditation
Many UK buyers ask for CREST membership, and some procurement frameworks require it. Accreditation shows that a company's processes have been independently assessed. It's a sensible baseline, but it doesn't replace asking who will test your systems and what you'll get back.
FAQs
What should I look for in a penetration testing company?
Named, experienced testers; mostly manual testing; a clear sample report; business-context risk ratings; authenticated testing; a fixed price; a retest; prompt reporting of critical findings; secure data handling; and sector understanding.
Talk to SMARTSEC
Ask us all ten.
Fixed-price testing, scoped and delivered by a senior tester, with live findings on the SMARTSEC client platform.
Estimate your test →