Our methodology

Where our firm data comes from

Every company in this directory is a real, publicly-verifiable UK firm. We compile listings from public sources — the CREST Marketplace, the NCSC CHECK list, certification registers, and the firms’ own websites — and we record the source of every listing. We never invent a company, a review, or a credential, and we never list a firm we have not confirmed exists.

How we verify accreditations

Accreditations such as CREST, NCSC CHECK, and ISO 27001 are the objective quality signals a buyer can check. For each one we display, we record whether we could verify it against a public register:

• Verified — we found the accreditation on a public record and link that record on the firm’s profile, so you can check it yourself.
• Claimed, unverified — the firm states the accreditation but we could not confirm it against a public register. We label it clearly and never present it as confirmed.

Listing tiers

Each listing carries an honest status:

• Listed from public sources — compiled from public records; the firm has not claimed or edited the listing, and we have not published an independent review, so it carries no rating.
• Reviewed — we have applied this methodology and published an independent review. Only these listings ever carry an opinion score.
• Claimed & verified — the firm has claimed its listing and we have confirmed its identity.

How “best” lists are ordered

Where we present a “best companies” list, we order it by the depth of accreditation we could independently verify — not by an opinion we haven’t earned the right to give, and never by who paid. There is no single best pentest firm; the right provider depends on your scope, sector, and compliance needs, which is why the directory lets you filter rather than handing you a single ranking.

How we make money — and how we keep it separate

We may earn from clearly-labelled featured placements and from referring buyers to firms. None of that ever changes the editorial order or the accreditation data. Featured placements are always visibly marked and sit outside the ranked order. If we cannot keep a commercial arrangement separate from the editorial record, we don’t take it.

Corrections

If a listing is wrong or out of date, we want to fix it. A firm can ask us to correct or claim its profile, and anyone can flag an error. We date every listing with when it was last verified.