Choosing a penetration testing partner requires more than comparing prices. The right provider tests the systems that matter, explains its methods, protects sensitive data, and helps engineers fix verified flaws. A sales call cannot show whether testers understand business logic, cloud permissions, mobile behavior, or release deadlines. Before signing a statement of work, buyers should ask about scope, evidence, communication, retesting, and accountability. The answers reveal whether a partner can produce useful evidence. Start with the first question.
A credible review starts with scope, access, rules of engagement, and a written definition of success. When comparing a pen testing company with another, look for teams that test real attack paths rather than simply running scanners. The report should connect each finding to evidence, business impact, and a practical fix, then confirm whether the fix works. Before approval, review the testing method and a sample of the report.
1. What Exactly Will Be Tested?
Ask for an asset list covering applications, APIs, mobile builds, cloud accounts, networks, and supporting services. The scope should name production and staging targets, test windows, excluded systems, and approved access methods. A vague scope creates disputes after testing begins. Require written approval for every target before work starts.
2. What Method Will Be Used?
Ask whether testing is manual, automated, or mixed. Manual review matters for business logic flaws, chained exploits, authorization failures, and unusual workflows. Automated scans provide breadth, but scan output alone does not prove exploitability. The contract should state how testers validate findings and remove false positives before delivery.
3. Who Will Perform the Work?
Ask who performs the work and whether named testers will remain assigned. Review relevant application experience, testing credentials, employment status, and location. A buyer should know who receives credentials and source code. If subcontractors or rotating staff enter the process, the agreement should describe approval, access controls, and confidentiality requirements.
4. How Will Data Be Protected?
Ask how the provider stores credentials, source code, screenshots, logs, and exported data. The agreement should define encryption, access permissions, retention periods, deletion procedures, and breach notification. Ask where testing data is stored and which employees can access it. Require confirmation that sensitive evidence will not enter public systems.
5. What Will the Report Contain?
Ask for a redacted sample report before signing. It should show affected assets, reproduction steps, evidence, severity reasoning, business impact, and remediation guidance. Each finding should identify the vulnerable condition, not just name a category. A useful report lets an engineer reproduce the issue and helps a manager track its status.
6. How Are Findings Retested?
Ask whether retesting is included, how fixes are submitted, and what evidence confirms closure. A retest should verify the original attack path and check whether the change created a related weakness. The agreement should state the retest window, included attempts, reporting format, and how unresolved findings are handled.
7. Can the Work Support Compliance?
Ask which compliance requirements the testing maps to and which evidence auditors receive. A compliance-focused engagement should connect scope, methods, findings, remediation, and retesting to the requested control. Buyers should confirm whether the report supports their audit deadline. A generic report cannot replace evidence tied to the actual control set.
8. How Will Communication Work?
Ask who handles urgent findings, how quickly the team reports severe issues, and where questions are tracked. Testing needs a named contact on each side, scheduled status updates, and an escalation path for service disruption. Clear communication helps engineers investigate findings while testers still have access to the relevant environment.
9. What Does the Price Include?
Ask whether the quote includes planning, testing, reporting, meetings, remediation support, and retesting. Confirm costs for added assets, changed dates, repeat testing, travel, and extended access. A low initial price can become expensive when ordinary project steps sit outside the statement of work. Require every assumption in writing.
10. Can the Partner Prove Its Claims?
Ask for references from organizations with similar technology, scope, and regulatory needs. Check whether the provider can explain missed findings, testing limits, conflicts, and remediation outcomes without relying on vague success claims. Before approving the engagement, review the termination clause, liability terms, confidentiality language, and report ownership.
Conclusion
Signing should follow evidence, not enthusiasm. A buyer who receives precise scope, named testers, secure data-handling terms, sample reporting, retest rules, and clear pricing can compare partners on documented work rather than promises. The next step is a written questionnaire based on these ten points. Send identical questions to each finalist, require written answers, and reject any proposal that leaves ownership, access, or remediation responsibilities unclear before requesting a signature.
