Before hiring a penetration tester, ask about their method, who will do the work, how they handle safety and your data, what the report contains, and whether retesting is included. Good answers are specific. Vague answers about proprietary tools and sophisticated techniques are a warning.
1. What method do you follow?
Good answers name public references and describe phases. For web applications, the OWASP Web Security Testing Guide is a free resource for testers. NIST SP 800-115 is a general guide to technical security testing and assessment. A provider need not follow either exactly, but should explain their approach and where they depart from it.
2. Who will do the work?
Ask who actually tests your system, their experience with your technology, and how junior staff are supervised. Request a sample of that person's previous work, redacted. If the senior name in the sales call will not be on the engagement, know that before signing.
3. How will you scope and what is excluded?
The proposal should describe targets, access levels, test windows and exclusions. Check that scope matches your risk, not just the cheapest option. Ask how they treat out of scope discoveries.
4. How do you keep testing safe?
Look for an agreed stop condition, an emergency contact, rules about data access, and care with production. Ask what they do if they find real customer data or another party's compromise. A good provider has a written answer.
5. How do you handle our data?
Findings, screenshots and credentials are sensitive. Ask where they store them, who can access them, how long they keep them, and how they destroy them. Ask whether subcontractors are involved. Ask how they transmit the final report.
6. What will the report contain?
Request a sample. See how to read a penetration test report for what to look for: scope, method, findings with evidence and reproduction steps, severity reasoning, and recommendations tied to root causes. Ask whether you get an executive summary and a short version you can share with customers.
7. What happens after the report?
Ask whether a debrief call is included, whether you can ask questions for a stated period, and whether retesting of fixes is included or charged. Ask how long after the fix a retest is available.
8. How do you deal with disagreement?
You may disagree with a rating or a claim. A good provider will discuss the reasoning and record both views. Ask what the process is. Be wary of any provider who treats questions as hostile.
Warning signs
- Promises to find everything or guarantee a pass.
- No sample report.
- Heavy reliance on automated scanner output presented as a manual test.
- A fixed price with no scoping call.
- Unwillingness to name method or staff.
- Pressure to sign before you have scoped.
Match the test to the reason
If a customer or auditor requires a test, ask them what they need: a named type, an independent party, a recent date, or a summary. Check requirements with the person who asked rather than guess, since frameworks differ.
Compare candidates side by side
Score each candidate from one to three on the eight questions and note your reasoning. A simple list helps you avoid choosing on price alone.
Quick check
Should we pick the cheapest provider?
Not on price alone. Compare scope, who does the work and what you get after the test.
Can we use the same provider every year?
You can, but a fresh pair of eyes sometimes finds different issues. Some teams alternate.
Sources
Last reviewed: 19 October 2026.
