There are hundreds of penetration testing companies, and most of their proposals read the same: experienced team, OWASP methodology, detailed report, fast turnaround. The differences that matter only show up after you have paid: who actually tests your systems, how deep they go, and whether the report helps your developers fix anything.
This guide is not a ranking. Rankings of pentest companies go stale fast and rarely reflect your stack, your budget or your compliance needs. Instead, it gives you the criteria, the red flags and the questions that let you evaluate any provider, from a two-person boutique to a global consultancy or a PTaaS platform. If you are new to the topic, start with what penetration testing is and come back.
What a pentest company actually sells
A penetration test is time from skilled people, spent attacking your systems under an agreed scope, and a written record of what they found. That means you are buying three things:
- Talent: the individual testers assigned to your engagement, not the logos on the website.
- Process: how scope is defined, how testing is authorized, how findings are validated and how data is handled.
- Output: the report and the retest. A great test with a useless report is a bad purchase.
Keep those three in mind when proposals start looking identical. Every criterion below maps to one of them.
Engagement models compared
Before comparing companies, decide which model you need. The label "pentest company" covers very different delivery models:
| Model | How it works | Best for | Limits |
|---|---|---|---|
| Traditional consultancy | Scoped, time-boxed engagement; report delivered at the end | Annual compliance tests, complex infrastructure, regulated industries | Point in time; findings arrive weeks after testing starts |
| PTaaS platform | Human testing delivered through a platform; findings streamed, retests on request, often a subscription | Teams that ship often and want recurring tests with less friction | Depth varies by provider; check who the testers are |
| Boutique specialist | Small team focused on one area (web apps, mobile, cloud, hardware) | Deep testing of a specific technology | Limited capacity; may not cover broad scopes |
| Bug bounty / crowdsourced | Many independent researchers paid per valid finding | Mature programs that already fixed the basics | No coverage guarantee; not a substitute for a scoped test |
| Continuous automated testing | Tools that scan code, dependencies and configuration on every change | Catching common flaws between human tests | Misses business logic and chained attacks that need human creativity |
Most teams end up combining two of these: a periodic human test plus continuous automated coverage. You can read more about the platform model on our penetration testing as a service page.
How to choose a penetration testing company: 8 criteria
1. Certifications, at company and tester level
Certifications do not prove a tester is good, but they prove a baseline. Check two levels:
- Company level: CREST accredits member companies after assessing their processes, and it publishes a member directory on crest-approved.org with more than 500 members worldwide. In the UK, the NCSC CHECK scheme approves providers for public sector and critical national infrastructure testing.
- Tester level: hands-on exams matter most. OffSec's OSCP (OffSec Certified Professional, earned through PEN-200 and now issued as OSCP+) is the common entry bar. OSWE (OffSec Web Expert, WEB-300) is relevant for web application and source code review work, and OSEP (PEN-300) for advanced internal network testing. CREST also certifies individuals through CRT (CREST Registered Penetration Tester) and CCT (CREST Certified Tester, Infrastructure or Application).
The key question is not "does your company have certified people" but "will the people testing my application hold these certifications, and can I see their experience?"
2. A named, documented methodology
A credible provider can tell you which methodology they follow and how they adapt it: PTES (Penetration Testing Execution Standard) for the overall process, the OWASP Web Security Testing Guide (WSTG) for web applications, NIST SP 800-115 for technical testing in regulated environments. For web apps and APIs, they should cover the OWASP Top 10 as a minimum, not as the whole test.
Ask how much of the time is manual. A test that is mostly an automated scanner with a cover page does not find authorization bugs like IDOR, which need a human to understand who should see what.
3. Scope that matches your real risk
Poor scoping is the most common reason a pentest disappoints. A good company asks questions before quoting: which applications, APIs and environments; how many user roles; whether cloud accounts and CI/CD are in scope; whether social engineering is allowed. Be suspicious of a quote given without any scoping call.
Also decide the testing perspective. Black-box testing simulates an outside attacker with no knowledge. Grey-box gives testers accounts and some documentation. White-box penetration testing gives access to source code, which usually finds more per hour because testers do not waste time guessing.
4. Report quality
The report is the deliverable you keep. Ask for a redacted sample and check that each finding includes severity with a CVSS score (FIRST published CVSS v4.0 in November 2023, and many providers still use v3.1), a CWE reference, affected asset, reproduction steps, evidence, business impact and a concrete remediation. There should also be an executive summary a non-technical reader can understand. Our pentest report template shows what a complete report looks like, so you can compare samples against it.
5. Retest included
A pentest without a retest tells you what was broken, not whether you fixed it. Confirm whether one retest is included, how long after delivery you can request it, and whether the retest produces an updated report or letter you can show customers and auditors.
6. Pricing model
Pentest pricing varies widely with scope, so compare models rather than headline numbers:
- Fixed price per engagement: predictable, but only as good as the scoping behind it.
- Day rate (time and materials): flexible, but the total depends on how many days the provider estimates.
- Subscription (common in PTaaS): recurring tests and retests for a periodic fee; useful if you ship often.
- Pay per finding (bug bounty): you pay for results, not for coverage.
A quote far below others for the same scope is not a bargain. It usually means fewer tester days or an automated scan labeled as a pentest.
7. Rules of engagement and legal basics
Professional providers insist on a signed authorization, clear rules of engagement (testing windows, contact for emergencies, what is off limits), an NDA and a statement about how they store and delete your data and credentials. If you are hosting on a cloud provider, they should know that provider's testing policy.
8. Communication during the test
Critical findings should not wait for the final report. Ask how they escalate a critical issue found on day two, which channel they use and who your point of contact is.
PTaaS vs traditional pentest companies
The main difference is delivery, not testing quality. A traditional company runs a project and hands over a PDF. A PTaaS provider gives you a platform where findings appear as they are validated, you can comment on them, assign them to developers and request retests. PTaaS fits teams that release weekly and need recurring tests; a traditional engagement often fits a yearly compliance requirement or a complex infrastructure scope. Some companies offer both. Either way, apply the same criteria: who tests, how, and what the output looks like.
Red flags
- The sample report is mostly raw scanner output with generic remediation text.
- They refuse to share a redacted sample report or the profile of the assigned testers.
- No named methodology, or "we follow OWASP" with no detail.
- A quote without a scoping conversation.
- No authorization letter or rules of engagement before testing starts.
- No retest, or a retest priced as a full new engagement.
- Promises such as "we guarantee to find every vulnerability" or "100% secure after our test".
- Every finding rated critical, or every finding rated low. Both suggest severity was not really assessed.
Questions to ask before you sign
- Who exactly will test our systems, and what certifications and experience do they have?
- Which methodology do you follow, and how much of the test is manual?
- Can we see a redacted sample report for a similar application?
- How do you score severity (CVSS version) and map findings (CWE)?
- Is a retest included, and within what time window?
- How do you escalate critical findings during the test?
- How do you store, protect and delete our data, credentials and source code?
- Do you test with source code access (white-box) if we provide it?
- Do you use subcontractors?
- What will the final deliverable look like for our auditors or customers?
Get more out of the pentest you buy
Human pentest time is expensive, so do not spend it on findings a tool could have caught. Before the engagement, fix the basics: vulnerable dependencies, hardcoded secrets, obvious injection and misconfigured CI. Our guide to open source vulnerability scanners and the overview of penetration testing tools cover free options, and a code security audit gives you a baseline.
This is where continuous white-box testing of the code complements a human pentest instead of replacing it. With Nurbak you connect GitHub and scan a repository: its own self-hosted AI model analyzes the code (the analysis does not send your code to OpenAI or Anthropic) and reports exploitable vulnerabilities with file and line, dependency CVEs, GitHub Actions, Docker, Terraform and Kubernetes misconfigurations and secrets in git history, with a 0 to 100 score and plain-language explanations. It runs between engagements, so when the pentesters arrive they spend their days on business logic and chained attacks. See how that fits with AI pentesting or start with a free scan that shows the three most important findings in full.
Bottom line
The right penetration testing company is the one whose people, process and report fit your risk, not the one at the top of a list. Ask for the sample report first, confirm who will test, insist on a retest and match the engagement model to how often you ship. Combine a periodic human test with continuous code testing, and each dollar of pentest time goes further. If recurring human testing through a platform sounds like your case, compare options on our PTaaS page.