Choosing a provider

Questions to ask a pentest provider before you sign

24 questions to ask a pentest provider, grouped by scope, people, method, report, retest and contract. Each has the reason to ask and a good answer signal.

By Excession Labs · · 5 min read

Short answer

Ask a pentest provider 24 questions in six groups: scope, who tests, method and safety, report, retest and contract. Each question below has a reason and a good answer signal. A vague or sales-only answer to scope, evidence or retest questions is the strongest warning sign before you sign.

These 24 questions help you compare pentest providers on the same terms. Send them in writing with your scope. Each row says why the question matters and what a good answer looks like. A provider that answers 20 of them clearly and admits gaps on the rest is easier to trust than one that answers all 24 with sales copy.

Scope questions#

Scope decides what you pay for and what stays untested. Start here, because every later answer depends on it.

# Question Why it matters Good answer signal
1 Which of my assets do you test: web app, API, cloud, network, mobile, AI features? Providers differ. In our dataset, 8 of 14 do not state cloud testing on their pages, and a "?" means the provider does not say. A yes or no for each asset type, with the assets named in the proposal.
2 What do you need from me to start: accounts, roles, API docs, test data? Missing roles cause shallow tests, because authorization flaws need two or more accounts. A written list with the number of accounts and roles per tenant.
3 Do you test in production or in staging, and what do you avoid? Testing writes data. Destructive proofs on production can break users. Test-owned accounts and records marked as test data, and a stated list of avoided actions.
4 How do you handle third-party and cloud providers in scope? Hosting providers set their own rules. AWS says customers may test listed services without prior approval, and that testing with command and control needs prior approval. The provider knows the host's policy and tells you what it needs from you.
5 What is explicitly out of scope, and what happens if you find something out of scope? An unplanned finding on a neighbor system is a legal and safety problem. A stop rule: the tester halts, reports to your contact and waits for written approval.

Questions about who tests#

The report names a company. The work is done by people or by software, and you should know which.

# Question Why it matters Good answer signal
6 Who or what does the testing: staff, freelancers, a crowd, an AI agent, or a mix? Delivery types differ. Cobalt and Synack use vetted external testers. XBOW and Horizon3.ai run autonomous platforms. See PTaaS versus traditional testing. A plain description of each role, with the human steps named.
7 Does a human review each finding before I see it? Automated tools produce false positives. Review cuts noise. Yes or no, and who reviews. "AI verifies" is a different claim from "a person reviews".
8 What credentials do you hold, and what do they cover? PCI SSC guidance says certifications are not required and that qualifications "cannot be met by certifications alone". Badges are a start only. The scheme name, what it covers (a company or an individual) and a link to the public register.
9 Are the testers independent of the systems they test? PCI DSS expects organizational independence for the tester. PCI SSC guidance says a firm that installed or supports the target systems cannot also test them for PCI. A direct statement about independence and any prior work on your systems.
10 Will the same people test and write the report? Handoffs lose detail. Named roles, or a statement that the tester writes the findings.

Method and safety questions#

A method you cannot inspect is a method you cannot compare.

# Question Why it matters Good answer signal
11 What methodology and guides do you follow? A named guide such as OWASP's Web Security Testing Guide or API Security Top 10 gives you a coverage baseline. Names the guides and says where the test goes beyond them.
12 How do you test business logic and authorization, beyond known vulnerability classes? Scanners miss flaws that depend on how your app works. Examples: two-account tests, workflow-skip tests and limit tests.
13 What is the evidence standard for a finding? A "success" response is not proof of an effect. A finding needs an effect shown by request, response and read-back.
14 What controls do you run next to each exploit attempt? Controls tell you what held. Nonexistent IDs, wrong tokens and anonymous comparisons are listed in the plan.
15 What are your safety limits for uploads, password guessing, email and paid APIs? These tests cost money or touch real people. Bounded tests, stated cost, and a rule to stop.

Report questions#

Ask to see the shape of the output before you buy. The sample report guide lists nine signals to check.

# Question Why it matters Good answer signal
16 Can I see a sample or a redacted real report? Four of 14 providers in our dataset publish a sample and two give one on request. A link or a file within the sales process, with no gate that hides the content.
17 What does each finding include? You need steps your engineer can repeat. Description, impact, evidence, reproduction, remediation.
18 How do you define severity? An undefined severity cannot be ranked or challenged. A written four- or five-level scale, or a stated CVSS version.
19 What formats and summaries do you deliver, and can I share a version with customers? Your buyers may ask for a summary or letter. No standard defines a letter, and PCI SSC calls its report outlines "only suggested outlines". Full report plus a customer-safe summary, with a clear statement on what it claims.

Retest questions#

Fixing is half the work. Verification is the other half.

# Question Why it matters Good answer signal
20 Is a retest included, for how long, and how many? Terms vary widely. HackerOne's docs describe unlimited retests during a remediation period of typically 30 or 90 days. Cobalt's pricing table shows 6 or 12 months of free retesting while its FAQ says unlimited during the contract. TurboPentest describes a retest as a new pentest at the same per-target price. Secure Ideas lists retesting only as a factor that can change a quote. The terms in writing, with the window, the limit and any fee after the window.
21 How long after I report a fix do you retest? HackerOne's docs say results usually arrive in around 72 hours once a tester claims the request. A stated time and the conditions it depends on.

Contract and price questions#

Price is only comparable when the unit and the inclusions are known.

# Question Why it matters Good answer signal
22 What is the price unit: per test, per target, per year, credits? Units differ. Aikido, TurboPentest and Secure Ideas publish prices in different units. See the cost guide. One total for your scope, plus what moves it.
23 What happens if scope grows or the test needs more time? Overrun terms drive the final cost. A rate, a cap or a change process in the contract.
24 How do you handle my data, reports and test accounts after the test? Reports hold your weaknesses. Retention period, access control, and deletion on request.

How to use the answers#

Put answers side by side in a sheet. Mark each as clear, partial or missing. A missing answer on scope (1 to 5), evidence (13), or retest (20) should slow the purchase. Missing answers on credentials or price can be fixed with a follow-up.

Use the provider table to see what each provider already states, and ask only about the gaps. If a provider tells you something that disagrees with its public pages, ask for it in the proposal. The proposal is the binding record.

Questions

How many providers should I ask?

Two or three is enough for most buyers. Send all of them the same scope and the same questions, so the answers are comparable. Compare the written answers, not the sales calls.

Should I ask for references?

You can, but a provider picks its own references. A redacted report from a real engagement of similar scope tells you more. Ask both, and treat a refusal to share any redacted work as a gap to note.

What if the provider answers 'it depends'?

Ask what it depends on. A good answer names the factors, such as number of roles, API endpoints or environments, and says how each moves the quote. An answer that stays vague after that is a signal about how the project will run.

Sources

  1. PCI SSC Penetration Testing Guidance v1.1 (September 2017) (checked 9 November 2026)
  2. AWS Penetration Testing policy (checked 9 November 2026)
  3. HackerOne docs: retesting pentests (checked 9 November 2026)
  4. Cobalt pricing page (retesting table and FAQ) (checked 9 November 2026)
  5. TurboPentest pricing page (checked 9 November 2026)
  6. Secure Ideas pricing page (checked 9 November 2026)
  7. PCI SSC summary of changes, PCI DSS v3.2.1 to v4.0 (checked 9 November 2026)
  8. Aikido pricing page (checked 9 November 2026)