Choose a penetration testing company by checking five things: the experience of the named testers, a written scope that matches your goal, independence from the systems tested, a documented methodology, and a sample report with retest terms. Certifications help but are not enough. This guide names no firms and ranks none.
Key takeaways
- The PCI Security Standards Council says experience and qualifications cannot be met by certifications alone, so ask about actual engagements.
- Independence matters: a tester who built or runs the target systems should not be the one testing them for a PCI assessment.
- A good scoping step states boundaries, effort in days, test accounts, reporting format and constraints, according to the UK NCSC.
- Read a sample report before you sign. It should name the issues, rate risk, and say how to fix each one.
- Ask who owns decisions after the report. The NCSC says risk assessment and fix decisions remain your responsibility.
Safeguard publishes this guide and sells security tooling, not penetration tests. We describe the guidance from PCI SSC and NCSC as written, and we do not name or rank testing firms.
What should you decide before you shop?
Decide what the test is for, because the answer shapes the whole search. Common goals are meeting a customer request, meeting a framework requirement, checking a new release, or testing a specific scenario such as a compromised host. The NCSC says a pen test is best seen as assurance over your own vulnerability management, not your main way of finding vulnerabilities.
Write one paragraph covering the goal, the systems in scope, and who needs to see the result. Every provider will ask for it anyway.
What qualifications should a pen tester have?
Ask about named individuals, not just company credentials. The PCI SSC guidance lists certifications as one indicator, including OSCP, CEH, several GIAC certifications, CREST certifications and CHECK. It adds that the council does not validate or endorse them, and that experience cannot be met by certifications alone.
Questions the guidance suggests asking include:
- How many years of experience does the tester have?
- How long has the organization been performing penetration tests?
- Has the tester assessed organizations of similar size and scope?
- Can the provider share references from other customers?
- If the tester is in their first year, what training and quality assurance does the organization have?
Does the tester need to be independent?
For PCI DSS, yes. The guidance says qualified internal staff or a qualified third party may do the test if they are organizationally independent, meaning separate from the management of the target systems. It gives an example: a company performing the PCI assessment cannot also perform the penetration test if it helped install, maintain or support the systems tested.
Other frameworks and customers may have their own wording, so check what your auditor or customer expects.
What should the scoping step produce?
A plan of action, in writing. The NCSC says the scoping output should state:
- Technical boundaries and test types.
- Timeframe and effort, usually in resource days.
- Scenarios or use cases, if relevant.
- Tester requirements such as test accounts and desk space.
- Compliance or legislative requirements.
- Reporting requirements, such as CVSS scores.
- Time constraints on testing or reporting.
If a firm quotes without asking questions about your systems, that tells you something about the quote.
How do you compare quotes?
Compare scope, not price. Two quotes with the same headline price can cover different asset counts, retest terms and amounts of manual work. Our cost guide lists sourced ranges and the questions that make quotes comparable.
Compare this table across every bidder.
| Criterion | What to ask | Why it matters |
|---|---|---|
| Testers | Who does the work, and what is their experience on similar systems? | Quality depends heavily on the tester, as the NCSC notes. |
| Scope | Which assets, environments and user roles are covered? | Prevents scope disputes after kickoff. |
| Test basis | Black-box, grey-box or white-box? | PCI SSC says black-box may need more time and money, and PCI tests are typically white or grey-box. |
| Effort | How many days, at what rate? | Quotes are built from effort. |
| Methodology | Which documented methodology do you follow? | PCI SSC lists industry-standard methodology references and asks that the methodology be documented. |
| Report | Can I see a redacted sample? | The deliverable is the product. |
| Retest | Is one retest included, and when? | Fix verification is often billed separately. |
| Safety | How do you avoid disrupting production? | The NCSC says unexpected reactions cannot be fully ruled out. |
What should a good report contain?
Issues found, a risk level for each, and a resolution method. The NCSC adds that a report should give an opinion on the accuracy of your vulnerability assessment and advice for improving it, and that a debrief should be available. The PCI SSC guidance lists a statement of methodology and details of how testing progressed. Our guide to what to ask for before you sign goes further on reports.
How to choose: a checklist
- The goal of the test is written down.
- Named testers have experience on systems like yours, and the provider offers references.
- The tester is independent of the systems tested.
- Scope, effort, accounts, reporting format and time limits are in writing.
- A documented methodology is named.
- A redacted sample report is provided before you sign.
- Retest terms and any extra fees are stated.
- You know who decides on fixes. The NCSC says risk decisions stay with you.
Frequently asked questions
Do penetration testing certifications matter?
They are an indicator. The PCI SSC says they are not required, do not replace experience, and are not validated or endorsed by the council.
Should I hire the firm that audits my compliance?
Check independence rules first. For PCI DSS, an assessor cannot perform the penetration test if it was involved in installing, maintaining or supporting the target systems.
Is a vulnerability scan the same as a penetration test?
No. A scan identifies known issues with automated tools. A penetration test attempts to exploit them. See our comparison of penetration testing and vulnerability scanning.
What if I only need a test for a customer questionnaire?
Ask the customer what they accept, such as a letter or report summary, and scope to that. Our guide on a penetration test summary you can send a customer covers the format.
Can I run a pen test internally?
The PCI SSC says qualified internal resources can perform the test if they are organizationally independent from the management of the target systems.
Sources
- NCSC, Penetration testing
- PCI Security Standards Council, Penetration Testing Guidance v1.1, September 2017. The guidance cites PCI DSS 11.3 numbering from the earlier standard version; confirm current requirement numbers in the standard itself.
Last reviewed: 19 October 2026.
