Choosing a penetration testing provider

Penetration testing is a trust purchase: you are inviting someone to attack your systems and handing them the results. A short list of direct questions reliably separates professional providers from the rest.

Why it matters

Providers vary in approach and depth, and a procurement process that compares on price alone can miss what matters most: how thoroughly the work is done and how clearly it is reported. The questions below help you compare on substance.

The questions to ask

• Ask who will actually do the testing and what certifications those consultants hold
• Ask how findings are validated and evidenced, and for a sanitised sample report before you commit
• Check the scope document is specific: named systems, defined rules, a written methodology
• Confirm findings come with evidence and a concrete fix, not just a severity score
• Confirm how your data and report are protected, stored and eventually destroyed
• Check insurance, and for government work, that personnel clearances match the environment

Local matters

For Australian organisations, and especially for government tenders, where testing is performed and where your data rests matters. Ask whether the work is done onshore, by whom, and under what agreements. A good provider will answer each of these clearly.