# Questions to ask a penetration testing company

Ask every firm on your shortlist the same questions. The answers show who will do the work, how they will do it, and what you will get for the price.

Online version: https://pentesting.org/toolkit/questions-to-ask-a-pentest-provider

## The testers

### Who will do the testing, and can we see their experience?

The people matter more than the brand. A good firm names the testers or describes their seniority and certifications.

Answer:

> 

### Are the testers your own staff?

If any work is passed to contractors or another firm, you should know who they are and that your contract covers them.

Answer:

> 

### Have they tested systems like ours?

Experience with your technology, such as a cloud platform or a type of application, makes the test faster and deeper.

Answer:

> 

## The method

### How much of the test is manual?

Scanners find known issues quickly; people find logic flaws and chain weaknesses together. Ask what the testers do beyond automated tools.

Answer:

> 

### Which standards do you follow?

For example the OWASP Web Security Testing Guide for web applications. It tells you what will be covered.

Answer:

> 

### How do you avoid disrupting live systems?

Look for a clear plan: agreed testing windows, care with tests that change data, and a named person to call if something goes wrong.

Answer:

> 

### What happens if you find something serious during the test?

You want to hear about a critical issue straight away, not weeks later in the report.

Answer:

> 

## The report

### Can we see a redacted sample report?

It is the best preview of what you are paying for. Judge it with the report checklist.

Answer:

> 

### How do you rate severity?

A named method, such as CVSS with the version stated, makes ratings consistent and comparable.

Answer:

> 

### Is a retest included, and for how long after the test?

A retest proves the fixes work. Know whether it is in the price before you compare quotes.

Answer:

> 

### Can we get a summary to share with customers or auditors?

Many buyers need a short letter or summary they can share without the full findings.

Answer:

> 

## Accreditation and assurance

### Which accreditations do you hold, and for which services?

Check the answer on the scheme’s own register, such as the CREST Marketplace or the NCSC CHECK list. Accreditation can cover some services and not others.

Answer:

> 

### What insurance do you carry?

Ask for professional indemnity cover and the amount, especially if production systems are in scope.

Answer:

> 

## Your data

### Where will our findings and data be stored, and for how long?

Reports describe how to break into your systems. Ask how they are protected and when they are deleted.

Answer:

> 

### How is the report sent to us?

Look for an encrypted portal or encrypted file, not a plain email attachment.

Answer:

> 

## Price

### How many days is the quote based on, and for which parts of the scope?

Days per scope item are the fairest way to compare quotes from different firms.

Answer:

> 

### What would change the price?

Extra environments, users, out-of-hours work or a retest can add cost. Better to know before you sign.

Answer:

> 

### When could you start, and when would we get the report?

Lead times vary. Check they fit your deadline, including time to fix and retest.

Answer:

>