Questions to ask before you buy a penetration test

Penetration tests are sold in many ways. These questions help you compare them.

1. Who does the testing? Named people with experience, or a tool run by someone else?
2. What exactly is in scope, and what is not? If the answer is vague, so will the report be.
3. How is access handled? A good test needs accounts for each role, and a clear rule on production data.
4. What do I receive? Ask for a sample report: evidence, steps to reproduce and advice, not just a score list.
5. Is a retest included? Fixes need checking. Know whether it is in the price.
6. How are findings handled while you test? A serious issue should reach you immediately, not in the final report.

A last check

Ask what the tester will not do, and what happens if something breaks. An honest answer to those is a good sign.