How to Choose a Penetration Testing Company

Most organizations buy a penetration test once a year, which means most buyers evaluate penetration testing companies without much basis for comparison. The proposals look similar, the certifications are alphabet soup, and the prices range from $2,000 to $60,000 for what is described in nearly identical language. Here is how to tell the difference.

The single biggest differentiator: manual testing vs. a scan with a logo

The cheapest “penetration tests” on the market are automated vulnerability scans with a cover page. A tool runs, output gets exported, a template gets filled in. It looks like a report. It finds none of the flaws that actually cause breaches.

Ask directly: what percentage of this engagement is manual testing, and who does it? A real answer sounds like “roughly 80% manual, performed by two senior testers, with tooling used for discovery and coverage.” An evasive answer , “we use industry-leading tools” , tells you what you’re buying. Our breakdown of automated vs. manual penetration testing covers what each approach actually catches.

The tell is in the findings. Scanners find missing patches and outdated TLS. Humans find broken access control between user roles, business logic that lets you skip a payment step, and chained exploits where three medium findings become one critical. If a sample report contains only the first category, the “test” was a scan.

Certifications that mean something

Individual tester certifications matter more than company badges:

• OSCP / OSCE (Offensive Security) , hands-on, 24-hour practical exams. The baseline credibility signal for an application or network tester.
• CREST (CRT, CCT) , rigorous, widely required in the UK and increasingly recognized in regulated industries. A CREST-accredited company has been assessed on process and quality, not just individuals.
• GPEN / GXPN (SANS/GIAC) , respected, particularly in enterprise and government contexts.

Be skeptical of firms that list only vendor-product certifications or generic security certificates for their testing staff. Those measure knowledge of a product or a framework, not the ability to break into things.

Methodology: ask which standard, and hold them to it

Any competent firm tests against a recognized methodology , OWASP Testing Guide / OWASP Top 10 for web, OWASP MASVS for mobile, PTES or NIST SP 800-115 for network and infrastructure. What matters is not that they can name one, but that the report maps findings back to it, so you can see coverage rather than take it on faith.

Ask: “Will the report show which methodology sections were covered, including the ones where you found nothing?” Coverage evidence is what separates a professional assessment from a list of whatever happened to turn up.

Judge the sample report before anything else

The report is the deliverable. Everything else is process. Any serious firm will provide a redacted sample , if one isn’t offered, that answers the question for you. When you read it, look for:

1. An executive summary a non-technical director can act on, not a page of tool output.
2. Reproduction steps precise enough for your developer to trigger the issue themselves.
3. Real evidence , requests, responses, screenshots , not just a CVSS score.
4. Impact stated in business terms: “an attacker could read other customers’ invoices,” not “insecure direct object reference.”
5. Remediation guidance specific to your stack, not a copy-pasted OWASP link.
6. Attack chains, where individually minor findings combine into a serious one. This is the clearest signal of genuine manual testing.

You can request our sample report and hold any other vendor’s to the same standard.

Retesting: included, or a second invoice?

You will fix the findings. Someone then needs to verify the fixes actually work, and that the patch didn’t introduce something new. Many penetration testing companies charge for that second pass, or cap it at a narrow window.

Ask: “Is retesting included, how long do we have, and does the final report reflect the fixes?” An included retest tells you the firm’s incentive is a secure outcome rather than billable days. (Ours is included in every engagement, which is also why our pricing is a fixed number rather than a day rate.)

Scoping and pricing: fixed scope beats an hourly promise

Vague scoping is where engagements go wrong. A firm that quotes before understanding your application count, endpoint count, user roles, and environment is guessing , and that guess gets corrected mid-engagement, in their favor.

Good signs: a structured scoping conversation or questionnaire, a written scope you can review, and a fixed price agreed up front. Bad signs: a quote in an hour with no questions asked, day rates with an open-ended estimate, or pricing that varies wildly depending on who you speak to. Our guide to penetration test cost covers what drives the number.

Independence matters for compliance

If the test is for SOC 2, PCI DSS, ISO 27001, or HIPAA, your auditor will ask whether the testers were independent of the people who built and run the system. A firm that also manages your infrastructure or wrote your code cannot credibly assess it. Confirm the firm has delivered tests accepted under your specific framework, and that the report maps findings to the controls your auditor examines , that’s the difference between evidence and a document you have to explain.

Big firm, boutique, or platform?

Three models, three trade-offs:

• Large consultancies , brand recognition that satisfies enterprise procurement, deep bench, formal process. Higher cost, and the senior expert who sold the engagement often isn’t the person testing it. Ask who is actually assigned.
• Boutique firms , senior testers doing the work directly, more flexibility, better value. Verify capacity and continuity, and check they can cover your full scope.
• Platform / PTaaS vendors , fast onboarding, a dashboard, subscription pricing. Quality varies enormously depending on whether real testers sit behind the platform or it’s mostly automated. Ask the manual-testing question above, and ask who the testers are.

None is inherently better. The failure mode is buying a brand and receiving a junior tester, or buying a platform and receiving a scan.

Ten questions to ask every vendor

1. What percentage of the engagement is manual, and who specifically will test?
2. What certifications do the assigned testers hold?
3. Which methodology do you follow, and will the report evidence coverage?
4. Can I see a redacted sample report?
5. Is retesting included, and for how long?
6. Is the price fixed, or an estimate that can change?
7. How do you handle findings that need urgent disclosure mid-test?
8. Will the report map to my compliance framework’s controls?
9. What does your scoping process involve?
10. Can you provide references from clients in my industry?

Any firm worth hiring answers all ten without hesitation.

Red flags

• A quote before any scoping questions
• No sample report available
• Retesting billed separately or not offered
• “Automated” or “AI-powered” as the primary selling point for a penetration test
• Prices dramatically below market (a real manual test involves days of senior time; the economics don’t allow $999)
• No named testers, no certifications, no methodology
• Cold outreach promising “guaranteed” vulnerability counts

The short version

The best penetration testing company for you is the one that does genuinely manual testing with certified senior people, works to a recognized methodology, produces a report your developers can act on and your auditor accepts, includes the retest, and quotes a fixed price after asking real scoping questions. Everything else , brand, dashboard, sales polish , is secondary to those six things.

If you want to see how we answer all ten questions, scope your assessment and we’ll send back a fixed-scope proposal, or request a sample report and judge the deliverable first.