How to Choose a Penetration Testing Company

Criterion 1

Tester certifications and qualifications

The certifications your testers hold are the clearest signal of skill — but only if you know what each one actually proves. Ask every provider: who specifically will perform the testing on your engagement, and what certifications do they hold? Then decode the answer, because the credentials are not interchangeable.

OSCP is the practical baseline: it is validated by a proctored 24-hour live exam against real systems, so a holder has demonstrably compromised machines under time pressure, not answered multiple-choice questions. OSWE and OSEP, from the same certification body, indicate advanced web application and evasion skill. CEH is a knowledge-level entry credential — broad and widely recognised in compliance contexts, but it is not proof of hands-on exploitation ability, so treat 'our testers are CEH certified' as a starting point for questions rather than an answer. GPEN and GWAPT (SANS/GIAC) validate network and web application testing skill respectively through rigorous curricula, and BSCP demonstrates practical web testing ability.

CREST works at two levels and is worth checking separately: CREST accredits firms (their processes, data handling and complaint routes), while CRT and CCT certify individual testers. A CREST-accredited firm employing non-CREST juniors is common — which is why the question is always about the named individuals on your engagement, not the company letterhead. For Indian regulated entities, one more check outranks all of these: filings with RBI, SEBI and several sector regulators must come from a CERT-In empanelled auditing organisation, so confirm empanelment in writing before you sign. Our VAPT certification guide decodes the full landscape.

• OSCP — hands-on exploitation skill; the gold standard, validated by a 24-hour live exam against real systems
• OSWE / OSEP — advanced application-security and defence-evasion skill beyond OSCP
• CEH — broad knowledge of attack techniques; more theoretical, widely recognised for compliance
• CREST — firm-level accreditation, plus CRT/CCT for individual testers
• GPEN — network penetration testing skill validated by SANS; GWAPT and BSCP for web applications
• CERT-In empanelment — mandatory for many Indian regulated filings; verify the certificate, not the claim
• Red flag: a provider who cannot name the specific individuals who will test your environment, or describes testers as 'certified' without specifying which certifications

Criterion 2

Methodology and framework alignment

Ask the provider what methodology they follow. A credible answer references PTES (Penetration Testing Execution Standard), the OWASP Testing Guide v4.2, NIST SP 800-115, or MITRE ATT&CK for red-team engagements — by name, unprompted.

Then ask for proof, because naming a framework costs nothing. Proof looks like: a proposal whose sections map to the framework's phases (compare it against the 8-phase engagement structure); a scope and rules-of-engagement template they can show you; and, for web engagements, the ability to say which OWASP test categories will be covered and which are out of scope. A provider who can walk you through their process phase by phase — what happens, what you receive, what they need from you — has a process. One who cannot is improvising at your expense.

Red flag: a provider who describes their methodology as 'industry standard' without naming a specific framework, or who cannot describe their testing process phase by phase.

Criterion 3

Report quality: the sample-report checklist

The report is the primary deliverable that justifies the cost, and a redacted sample tells you more about a provider than any sales call. Ask for one before engaging — refusal is itself an answer. Then read the sample against this checklist:

• Executive summary a non-technical leader could act on — overall risk rating, what an attacker could realistically achieve, and the three to five priorities that matter most
• Methodology and scope section describing what was tested, what was excluded, and which framework was followed — the section your auditor reads first
• Finding-by-finding documentation with CVSS score, affected systems, step-by-step reproduction instructions, and specific remediation guidance rather than 'apply vendor patches'
• Proof-of-concept evidence — screenshots or command output — for every exploited finding; findings without evidence are opinions
• An attack narrative showing how findings chained together, not just an isolated list
• Evidence of testing coverage — what was tested and found clean, not only what was found broken
• Remediation priority matrix sorted by severity, and a retest confirmation section
• Red flag: a report that is primarily automated scanner output without manual analysis, or lists findings without proof-of-concept evidence

Criterion 4

Retest policy

After your team remediates, you need confirmation the fixes held. Ask: is a retest included in the engagement price, or billed separately? A provider that bills separately for retests creates a disincentive to validate remediation properly. Quality providers include at least one retest cycle within scope.

Pin down the mechanics as well as the principle: the retest window (30–90 days after report delivery is typical — long enough to fix, short enough that the environment has not drifted), what the retest covers (every reported finding, not a sample), and what you receive at the end. The closing artefact should be a retest attestation — a signed statement of which findings were verified fixed — because that letter, not the original report, is what actually closes the engagement for your auditor and your enterprise customers.

Criterion 5

Critical-finding escalation, communication and data handling

Ask what happens if a Critical vulnerability is discovered mid-engagement. The correct answer: immediate notification to named contacts in the rules of engagement document, with documentation and a recommendation on whether to pause or continue testing that vector. A quality company also spends significant time on scoping, producing a written rules-of-engagement document covering in-scope and out-of-scope systems, permitted techniques, active testing hours, escalation contacts, and liability terms.

Communication cadence during the engagement matters almost as much as the escalation path: agree up front how often you hear from the testers (a short written status at least weekly on multi-week engagements), through which channel, and who on your side receives it. Silence for three weeks followed by a PDF is how surprises happen.

Finally, remember that a penetration test report is a working map of your weaknesses — treat the provider's data handling as part of the evaluation. Ask where findings and evidence are stored, who can access them, how long they are retained after the engagement closes, and how deletion is confirmed. A provider who has no ready answer for protecting your report should not be trusted to write it.

Red flag: a provider who sends a simple questionnaire and starts testing without a signed rules-of-engagement document.

Criterion 6

What a quality engagement costs

In India, a focused web application penetration test typically costs ₹1.5–4 lakh (USD 2,000–5,000). A combined network + web application VAPT for a mid-size environment runs ₹5–15 lakh (USD 6,000–18,000), and large multi-scope programmes covering cloud, API and mobile go beyond ₹25 lakh (USD 30,000+). US/EU-market engagements for comparable scope typically price two to three times higher. The final number depends on scope, asset count and whether a remediation retest is included.

Compare quotes on human tester days, not headline price: ask each shortlisted provider how many tester days the number buys and what seniority those days carry. Two quotes of ₹3 lakh are not equivalent if one is eight days of an OSCP-certified tester and the other is two days of scanner time with a report template. If a subscription model fits your release cadence better than an annual project, PTaaS pricing and trade-offs are covered in our companion guide.

At a glance

Vendor evaluation checklist

Use this as a scoring sheet across your shortlist — a provider should clear every row, not most of them.

Questions to ask every penetration testing company

Put these to every shortlisted provider in writing, and keep the answers with the contract — they become your acceptance criteria for the engagement.

• Who will perform the testing on my engagement, and can you provide their CVs and certifications?
• How many human tester days does this quote include, and at what seniority?
• Will testing be performed by your employees or subcontracted, and if subcontracted, to whom?
• What methodology do you follow, and can you walk me through your process phase by phase?
• Can I see a redacted sample report from a comparable engagement?
• Is a retest included in the scope, what window does it cover, and do we receive a retest attestation?
• What is your process if you discover a Critical finding during active testing?
• How often will we receive status updates during the engagement, and from whom?
• What happens to my data and evidence after the engagement closes, and how long is it retained?
• Are you CERT-In empanelled (required for many Indian regulated filings)?
• Have you tested environments similar to ours in size and technology stack, and can you share two references?
• What does your scoping process look like, and what documents are produced before testing begins?

Warning signs

Red flags that signal a low-quality provider

Any one of these is a reason to slow down; two or more is a reason to walk away, whatever the price.

• Provides a quote without asking about scope, environment size, or requirements
• Cannot name or provide CVs for the testers who will conduct the engagement
• Prices a 'VAPT' similar to a standalone vulnerability scan
• Promises a completed 'penetration test' of a complex environment in one or two days
• Cannot provide a sample report or reference engagements
• Does not mention a rules-of-engagement document or written scope agreement
• Offers significantly below-market pricing without a clear explanation
• Guarantees zero findings, or conversely guarantees Critical findings, before scoping
• Delivers findings in automated scanner output format with minimal manual analysis

Infronest

Conclusion

If you are delivering penetration testing engagements yourself or managing multiple VAPT programmes across clients, Infronest's Security and VAPT module provides the platform infrastructure you need: structured engagement management, finding documentation, CVSS scoring, evidence storage, peer review workflows, and audit-ready PDF report generation in one tenant-isolated workspace — the operational backbone behind every criterion this guide tells buyers to check.

Start your 14-day free trial at infronest.com — no credit card required.

Explore the Security & VAPT module →

Sources

Every figure and methodology reference in this article comes from the following published standards and reports. We cite them so you can verify the claims rather than take them on trust.

• MarketsandMarkets — Penetration Testing Market 2025–2031
• PTES — Penetration Testing Execution Standard
• CREST International; Offensive Security (OSCP)
• OWASP Testing Guide v4.2
• NIST SP 800-115 — Technical Guide to Information Security Testing
• PCI DSS v4.0