How to Choose a Penetration Testing Partner

Scanners are not penetration tests

Many providers run an automated scanner, rebrand the output and call it a penetration test. A real engagement combines tooling with human attackers who chain findings together the way a criminal would.

Five questions to ask

• Who does the testing? Ask for tester experience, not company history.
• What methodology? Expect OWASP, PTES or equivalent.
• What does the report look like? Ask for a sanitised sample.
• What happens after? Remediation guidance and retesting should be included.
• Are they certified? ISO 27001 operations protect your data during the test.

How often should we test?

Annually at minimum, plus after major changes to your applications or infrastructure.