How to choose a penetration testing company
You want a firm whose test you can show to an auditor or a customer without second thoughts, at a price that matches the job. Work through it in this order and the choice narrows quickly.
1. Be clear on what you need tested, and why
Choosing gets easier once the job is written down: the systems in scope, the reason for the test (a customer, an audit, a change you made) and the deadline. The reason decides what the report has to show. A test for PCI DSS or SOC 2 needs a report your assessor will accept; a test before a launch needs findings your developers can act on.
2. Shortlist firms that do this kind of test
Look for firms that describe the service you need on their own website, such as web application, cloud or internal network testing, and that work in your country. Our listings link each service to the page on the firm’s site that names it, and the matcher puts those firms first.
3. Check accreditation on the register, not the logo
A logo on a website is a claim. The register is the evidence. Look the firm up on the CREST Marketplace and, for public sector work, the NCSC’s list of CHECK companies. Our accreditation checker shows what each register listed when we last read it, with a link to the entry so you can confirm it there.
4. Ask about the people and the method
The testers matter more than the brand. Ask who will do the work and what they have tested before, and how much of the test is manual. CREST’s buyer’s guide explains why a mostly automated scan is not a penetration test. For web applications, a firm that follows the OWASP Web Security Testing Guide can tell you what it will cover. Our questions to ask a provider list the rest, with what a good answer sounds like.
5. Read a sample report
The report is what you are buying. Ask for a redacted sample and check that each finding explains the risk in plain words, shows how it was found and says how to fix it, and that there is a summary your customer or board can read. See what a good report looks like.
6. Compare quotes on the same scope
Send every firm the same description of the job, so the quotes differ only in price and approach. Check the days allocated, whether a retest of fixed findings is included and what the report contains. See what to send for a quote and what a test costs.
Signs to walk away
- A fixed price before anyone has asked what is in scope.
- No answer to “who will do the testing?”.
- An accreditation you cannot find on the scheme’s own register.
- A sample report that is a scanner export with a logo on it.
- No written agreement on what may be tested, when, and who to call if something breaks.
Next steps
Sources
Frequently asked
Do I need a CREST-accredited firm?
Not by law. CREST accreditation means the firm’s processes and testers have been assessed by CREST, and many customers and auditors ask for it. Check the firm on the CREST Marketplace itself rather than relying on a logo on its website.
When do I need an NCSC CHECK firm?
The NCSC says government systems that process data marked OFFICIAL and above should be tested by companies assured under its CHECK scheme. Outside the public sector and critical national infrastructure, CHECK is not required.
Is a big firm better than a small one?
Not for every job. What matters is that the people doing your test have tested systems like yours. A small firm can suit a small, focused test well; a large one can staff a big engagement quickly. Ask who will do the work.
Find firms that fit your test
Answer a few questions about what needs testing and why, and see matched firms with a link to each one’s contact page.
Match with firms