When choosing a pentesting company, evaluate who performs the test, how much is manual, what report is delivered, whether retesting is included, and whether the provider is independent of whoever operates your security. Price and brand come after these criteria.
This article was written by a company that sells pentesting services. The criteria below are those Vultus would use to evaluate itself.
Who performs the test?
Penetration testing depends on people. Tools support the work, but the highest-impact flaw usually emerges when someone chains together findings that seemed minor in isolation.
Ask for team members' names and each person's certifications, giving more weight to practical exams in which candidates must break into an environment within a time limit, such as certifications from OffSec (OSCP, OSEP, OSWE, and others). Confirm in the contract that the team presented during sales will perform the work.
Checking the team becomes more important in a market with a talent shortage. The Global Cybersecurity Outlook 2026, from the World Economic Forum, identifies the cybersecurity talent shortage as one of the sector's structural challenges.
How much of the test is manual, and what report does it produce?
Ask how many hours of manual testing are planned. A vague answer usually points to automated scanning with a formatted report.
Also request an anonymized report from a previous engagement. A good report includes an evidenced attack chain, an executive summary leaders understand without translation, and specific recommendations, such as requiring a second factor on an exposed admin panel, instead of generic guidance.
Methodology and rules of engagement
The provider should explain its work phase by phase and the references it relies on, such as OWASP Web Security Testing Guide for applications and MITRE ATT&CK for adversary tactics. A proprietary methodology adds value when it complements these references.
Before work begins, execution windows, out-of-scope systems, points of contact, and procedures for critical findings must be defined in writing. A reputable provider stops and immediately notifies the client upon finding something serious.
Independence from the team operating defenses
When the provider also monitors alerts, manages the firewall, or remediates vulnerabilities, the pentest evaluates its own work. This creates a conflict of interest that must be addressed.
For institutions authorized by the Central Bank of Brazil, independence has become a requirement: BCB Resolution 538 and CMN Resolution 5,274 require an annual penetration test performed by an independent company or professional, as detailed in the article on BCB Resolution 538. If the same provider handles both areas, ask how teams and contracts are separated and document the answer.
What happens after the report
The report is an intermediate step. Ask whether retesting, a platform for tracking remediation, and support for the technical team are included. In the 2026 Cyber Risk Landscape, a Vultus study of 132 organizations, governance ranked last among the maturity pillars, scoring 1.48 on a scale of 0 to 5. Finding vulnerabilities is the easier part; fixing them is where most companies get stuck.
Questions to bring to the provider meeting
Some warning signs deserve attention: a fixed price without a scoping meeting, a report promised in 24 hours for a large scope, promises of complete protection, and no questions about the business. The questions below help compare providers:
- Team: who will perform the work, and what practical certifications do they hold?
- Manual testing: how many hours are planned?
- Report: can we see an anonymized example?
- Retest: is it included, and within what timeframe?
- Critical findings: what is the procedure during testing?
- Independence: does the provider currently operate any part of the company's security?
- Context: what does the provider need to know about the business to test effectively?
Pentesting with a certified team and retesting
Vultus performs manual testing with an offensive security team and combines it with recurring validation by autonomous agents. Explore Vultus advanced pentesting and see how much a pentest costs.
