Questions to ask a pentest vendor

You cannot judge testing skill from a proposal, but you can judge it from how a firm answers questions about method, staffing and evidence. These are the ones that produce different answers from different firms, which is the whole point of asking.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

Ask every firm the same twenty questions in the same order and score the answers side by side. Most of the information you need is not in the proposal, because proposals are written to survive comparison. The five questions that discriminate hardest are who does the testing, what proportion of findings came from a tool, whether you can see a redacted report, what happens on retest, and what the firm would refuse to do. Everything else is confirmation.

Who actually does the testing

1. Who specifically will be on this engagement, and how long have they been at your firm? You want names and tenure. The answer you do not want is that it will be assigned from a pool nearer the date, because it means the person who scoped it is not the person who tests it.
2. Will any of the work be subcontracted? Subcontracting is normal and not disqualifying. Undisclosed subcontracting is. Ask whether the same background checks and confidentiality terms flow down.
3. Where will the testers be located while testing, and where will the evidence be stored? This is the one Canadian buyers forget to ask, and it matters for public sector work and for anything under Quebec's Law 25. See data residency during a penetration test.
4. What certifications do the assigned testers hold? OSCP, OSWE, CRTO, GPEN, GWAPT and GXPN are practical, hands-on qualifications. CISSP is a management credential and tells you nothing about whether somebody can test. If you are selling into the UK or the EU, CREST is the accreditation your customer is likely to recognise, and it is held by the firm rather than only by the individual. How much weight each one deserves is on CREST, OSCP and pentest certifications.

Method, and how much of it is a person

1. Which methodology do you follow, and can you name the sections? A firm that says PTES, OWASP WSTG, OWASP MASTG for mobile, or NIST SP 800-115 and can say which parts apply to your surface is telling the truth. A firm that names all of them and can say nothing further is reading a marketing page.
2. Roughly what proportion of findings in a typical report of this type came from automated tooling? There is no correct number and every tester uses tools. Listen for whether they can answer at all, and whether they can describe a finding from your kind of system that no scanner would have produced.
3. Give me an example of an authorisation flaw you found recently in an application like ours. Broken object-level authorisation is the most common serious finding in web and API testing and it cannot be found by a scanner, because a scanner does not know that order 1043 belongs to a different customer. A firm that cannot tell this story is selling you a scan, which is the argument on vulnerability assessment against penetration test.
4. How many tester days are you allocating, and how are they split between testing and reporting? Days times rate is the whole quote. If a firm will not give you days, you cannot compare their number to anyone else's. Check the arithmetic against penetration testing cost in Canada.
5. What would you refuse to do on this engagement? The best answer is specific: no denial of service, no testing of the payment provider's systems, no pretexting staff without HR sign-off. A firm that would refuse nothing has not thought about your environment.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

The report and what comes after

1. May I see a redacted report from a similar engagement? Ask before you sign. Almost every established firm has a sanitised sample and will send it under NDA. What to look for once you have it is on how to read a penetration test report.
2. Who owns the report, and may I give it to a customer? You want ownership and the right to share under NDA. A licence-to-view arrangement means the report cannot do the job you bought it for.
3. Do you provide an attestation letter, and is it included? This is the document most customers and insurers actually want, and it should be a named deliverable rather than a favour. See report against attestation letter.
4. Is a retest included, what does it cover, and how long is the window? Included, all findings, 90 days is the good answer. Included, high and critical only, 30 days is common and workable. Not included is a $1,500 to $6,000 CAD line item you will pay later. The terms are on retest and remediation verification.
5. How are severities assigned, and will every finding carry a CVSS vector string? A number with no vector cannot be checked. Ask which version, and see CVSS v3.1 against v4.0 for why the answer should be written into the scope.
6. Will there be a live readout with the engineers who have to fix this? An hour of the tester's time explaining findings to the people who will remediate them is worth more than another ten pages of report.

Commercial and contractual

1. What is in the rules of engagement, and can I see the template? Read it before signing anything. The clauses to refuse are listed on penetration test rules of engagement.
2. What insurance do you carry? Professional liability and cyber liability, with amounts. Ask for the certificate.
3. How long do you retain evidence and findings, and when are they destroyed? A stated period with a deletion commitment. "Indefinitely for quality purposes" means your credentials live on their file share.
4. What would make this quote go up after we sign? Honest answers exist: a scope that grows, an environment that is not ready, a discovered second application. Getting them on the call prevents the change order argument.
5. What is your lead time, and what happens if we slip? Good firms are booked four to eight weeks out. A firm available on Monday is either very new, very large, or has just lost a client.

Answers that should end the call

Scoring the answers

Write the twenty answers into one table with a column per firm before you form an opinion, because the firm you spoke to most recently always sounds best. Weight the five discriminating questions double. If two firms tie, take the one whose sample report reasons about impact in your context rather than pasting a vendor advisory, and whose quote shows tester days rather than a single number.

Price is the last tiebreak, not the first filter. The spread between the cheapest and dearest comparable quote in Canada is usually explained by tester days, and the day rate itself varies far less than buyers expect. Where the spread is not explained by days, you are looking at two different services with the same name on them.

Common questions