How to Choose a Penetration Testing Provider

Choose a penetration testing provider based on methodology, reporting quality, and post-test support — not just price

A penetration test (VAPT) is only as valuable as the provider running it. The difference between a thorough test and a checkbox exercise can mean the difference between finding critical vulnerabilities before attackers do — and paying for a report that sits in a drawer. According to OWASP, over 60% of penetration test findings are missed by automated scanners alone, which is why manual testing expertise matters.

What to look for in a provider

Methodology transparency

A reputable provider will explain their methodology before you sign. Look for alignment with recognised frameworks:

• OWASP Testing Guide — the industry standard for web application testing
• PTES (Penetration Testing Execution Standard) — comprehensive end-to-end methodology
• NIST SP 800-115 — US government standard, widely adopted in Australia
• AESCSF — Australian Energy Sector Cyber Security Framework (for critical infrastructure)

If a provider can't name their methodology or says "we use our own proprietary approach", that's a red flag.

Manual testing vs automated scanning

Automated scanners (Nessus, Burp Suite, OWASP ZAP) find known vulnerabilities quickly. But they miss:

• Business logic flaws — an automated scanner can't understand that a checkout process allows negative quantities
• Chained vulnerabilities — individual low-severity issues that become critical when combined
• Authentication bypasses — subtle flaws in session management or access controls
• Context-specific risks — issues that only matter in your particular business context

A good provider uses automated tools for discovery and manual testing for depth. If the quote only includes automated scanning, you're paying for something you could run yourself.

Reporting quality

Ask for a sample report before engaging. A quality pentest report includes:

• Executive summary — plain-English overview for business stakeholders
• Findings by CVSS severity — critical, high, medium, low, informational
• Proof of exploitation — screenshots, request/response pairs, and step-by-step reproduction
• Remediation guidance — specific, actionable fix instructions (not generic "patch your system")
• Prioritisation — what to fix first based on risk and business impact

If the sample report is mostly automated scanner output with no manual analysis, the test will be equally shallow.

Post-test support

The best providers include:

• Remediation verification — retesting fixed vulnerabilities at no extra charge
• Developer guidance — helping your team understand and implement fixes
• Ongoing relationship — availability for questions after the report is delivered

A provider who delivers a report and disappears is selling a document, not a security outcome.

Red flags to watch for

• Unusually low pricing — a thorough web application VAPT takes 3-5 days of skilled work. If someone quotes 1 day for a complex application, they're running automated tools and calling it a pentest
• No scoping call — a reputable provider asks about your application architecture, technology stack, authentication mechanisms, and compliance requirements before quoting
• Guaranteed results — no provider can guarantee finding a specific number of vulnerabilities. The findings depend on your application's security posture
• No insurance — penetration testing carries inherent risk. A professional provider has professional indemnity insurance
• Resistance to rules of engagement — a provider should welcome a clear scope, testing windows, and emergency contacts document

Questions to ask before engaging

1. "What methodology do you follow?" — look for OWASP, PTES, or NIST references
2. "What percentage of testing is manual vs automated?" — expect at least 40% manual
3. "Can I see a sample report?" — quality of the report reflects quality of the test
4. "Do you provide remediation retesting?" — this should be included
5. "Who will be performing the test?" — ask about the tester's certifications (OSCP, CREST, GPEN)
6. "What's your professional indemnity insurance coverage?" — this protects both parties
7. "How do you handle critical findings during the test?" — they should notify you immediately, not wait for the report

Expected cost ranges in Australia

• Basic website security check — $500-$1,500 (largely automated, good for simple sites)
• Standard web application VAPT — $3,000-$8,000 (automated + manual, 3-5 days)
• Comprehensive VAPT with API testing — $8,000-$15,000 (thorough manual testing, 5-10 days)
• Full infrastructure + application pentest — $15,000-$30,000+ (network, application, and social engineering)

These ranges are for Australian providers with qualified testers. Significantly lower quotes usually mean significantly less thorough testing.