On 30 June 2026 the OWASP Mobile Application Security project released MASTG v2.0.0, a rewrite of its mobile testing guide into roughly 860 modular, cross-linked components. Standards move that fast, and a vendor's proposal often reads the same as it did three years ago. That is a good reason to ask questions before you sign.
If an enterprise customer has asked for a penetration test report, you are about to buy a service you may never have bought before. Prices and slide decks tell you little. The answers to the questions below tell you a lot.
What's affected
This guide applies to any small or mid-size software company about to hire an outside firm for a web, API, mobile or cloud test. It does not cover bug bounty platforms, which work differently.
The questions fall into five groups: people, method, safety, deliverables and independence.
How to check if you're exposed
You are exposed to a bad purchase if you cannot answer these five checks about a proposal you already have in hand:
- Does it name the testers, or only the firm?
- Does it say which standard or guide the test follows?
- Does it state days of effort, not just a price?
- Does it describe what happens to your data and credentials afterwards?
- Does it include a retest?
If two or more answers are "no", ask for a revised proposal before comparing prices.
What to do now
- Ask who actually tests. The UK NCSC says third-party tests "should be performed by qualified and experienced staff only" and that the quality of a test is closely linked to the abilities of the testers involved. Ask for the names or at least the seniority of the people assigned, and how many similar systems they have tested. NIST SP 800-115 lists the baseline skill for penetration testing as extensive TCP/IP, networking and operating system knowledge plus advanced knowledge of vulnerabilities and exploits.
- Tell them about oddities early. NCSC advises mentioning unusual systems during the bid so providers can confirm they have the right skills. A GraphQL gateway, a mobile app with certificate pinning or an LLM feature all count.
- Ask which guide they test against. For web and API work, OWASP's API Security Top 10 (2023) and the web Top 10 are common references. For mobile, ask whether they use the current MASTG and which MASVS control groups they cover. For AI features, ask about the OWASP Top 10 for LLM Applications 2025.
- Ask for effort, not only price. NCSC describes a scoping output that includes timeframe and effort, usually in resource days. A fixed price with no days is hard to compare.
- Ask how they stay safe. Do they avoid denial of service? Will they stop and call you if they reach real customer data? Will they work from a fixed source IP range you can allow and watch?
- Ask what they do with your data. Where are screenshots, notes and credentials stored, and when are they deleted? Who can read your report inside the firm?
- Ask what the report contains. Ask for a redacted sample. Look for reproduction steps, evidence, a rating method (CVSS or another named scale) and a fix recommendation per finding.
- Ask about the retest. Is a verification round included, and for how long after the report? PCI DSS v4.0 requirement 11.4.4 says penetration testing is repeated to verify corrections of exploitable vulnerabilities.
- Ask about independence. PCI DSS 11.4.2 and 11.4.3 ask for a qualified internal resource or qualified external third party, with organizational independence of the tester. If the firm also built your product, say so to your assessor.
How to avoid this trap
- Compare at least two proposals on the same scope sheet, so the differences are the vendors and not the scope.
- Put the retest, data handling and source IP range into the contract, not a slide.
- Name one technical contact on your side who can answer within the hour during the test. NCSC suggests exactly this.
Why it matters
A penetration test is only as useful as the people doing it and the scope they were given. A cheap, vague test produces a PDF that satisfies nobody who reads it closely. An enterprise security team will often read the scope page first.
Good vendors like these questions. If a firm gets defensive about naming testers or sharing a sample report, that is information.
Quick check
Why ask for days of effort and not only a price?
Effort in resource days is how NCSC describes test scope. Two firms with the same price may plan very different amounts of hands-on testing.
Which PCI DSS requirement says tests are repeated to verify fixes?
Requirement 11.4.4 in PCI DSS v4.0 says penetration testing is repeated to verify the corrections of exploitable vulnerabilities and security weaknesses.
