Penetration testing proposals are unusually hard to compare. They use the same vocabulary, cite the same methodologies, and arrive within a similar price range. The difference between the best and worst of them is enormous, and almost none of it is visible on the proposal.
These seven questions are the ones that produce genuinely different answers.
1. "Can I see a sample report — a real one, redacted?"
This is the single most revealing question, and a surprising number of firms cannot answer it. A sample report shows you the actual output you are buying.
Look for: a narrative of how findings were chained, not just a table; reproduction steps you could follow yourself; a root-cause note per finding rather than a generic remediation paragraph; and evidence of manual work — screenshots of crafted requests, not scanner output pasted into a template.
If the sample is a scanner export with a cover page, that is what you will receive.
2. "Who specifically will test, and what have they done?"
Many firms sell with senior staff and deliver with whoever is free. Ask for the named tester and their background. You are entitled to know this before signing, and the answer tells you whether the firm has depth or a single capable person who is already oversubscribed.
3. "How much of this engagement is manual?"
Every honest test uses automation for coverage. The question is what happens afterwards. Ask how many days are budgeted, and what the tester does on day three once the scan has finished.
A useful follow-up: "What kinds of finding would your scanner miss that you expect to find by hand?" A tester who can answer that specifically — business logic, authorisation between accounts, race conditions, chained low-severity issues — is describing work they actually do.
4. "Is a retest included, and for how long?"
A finding you have fixed but cannot evidence as fixed is still an open finding in your client's eyes. Retesting should be included, with a stated window — thirty to ninety days is normal. If retesting is a separate quote, factor it into the comparison, because you will need it.
5. "What do you need from us, and what breaks?"
A firm that has done this before will tell you exactly what they need — credentials for each role, a test environment or a maintenance window, allow-listing for their source addresses, a named contact for the duration.
They will also warn you about disruption honestly. Testing can lock accounts, fill logs, trigger alerts and occasionally take something down. A vendor who promises zero impact on a production environment is either not testing hard or not telling you the truth.
6. "How do you handle a critical finding mid-test?"
The correct answer is that they stop and call you the same day, in writing, with enough detail to act. Not "it will be in the report". If an authentication bypass is found on Tuesday, waiting until the report lands the following week is two weeks of exposure you did not need.
7. "What is explicitly out of scope?"
Good scoping documents are specific about exclusions: no denial of service, no social engineering of staff unless separately agreed, no testing of third-party services you do not own. Vague scope protects the vendor, not you — it allows a thin test to be defended as "within scope".
Things that look like signals but are not
A long list of certifications on the proposal tells you about the firm's marketing, not the tester assigned to you. Logos of well-known clients are frequently from a single small engagement years ago. And an unusually low price is not always a bad sign — it is often a scan, which may be exactly what you need, but you should know that is what you are buying.
One last check
Ask them to describe a test where they found nothing serious. A firm that says it has never happened is either not testing mature environments or not being straight with you. The useful answer describes what they did with the remaining time and what the report said instead.
0 comments
Leave a comment