Choose a security-testing provider
Compare testing proposals using evidence of relevant experience, coverage, reporting quality, safe delivery and follow-up arrangements.
Compare providers against the same question and scope. A lower price can represent less testing, different access assumptions or no retest; a higher price does not establish better evidence.
Start with a written scope and ask each provider to explain how its proposed work will answer the business question. Separate essential conditions from preferences before scoring the proposals.
Set the essential conditions first
Do not let a good total score compensate for a missing requirement. For a fictional customer-portal assessment, the owner might require:
- Written agreement on the assets, roles and authorised activities.
- A named lead with relevant application and API testing experience.
- A secure way to exchange accounts, findings and reports.
- A clear emergency contact and procedure for stopping the test.
- Reporting that separates demonstrated findings from untested assumptions.
- Any assurance, contractual or procurement conditions that actually apply to the organisation.
Ask the provider to explain subcontracting, substitutions and who reviews the final report. Agree whether a change of lead or delivery location needs your approval.
Use qualifications as evidence in context
The NCSC CHECK buyer guidance describes a scheme directed at public-sector and critical-national-infrastructure testing. It also explains that private-sector penetration testing does not generally have to use a CHECK provider. Establish your actual requirement rather than treating one scheme as compulsory for every buyer.
Where a proposal claims an accreditation or individual qualification, check the relevant issuer's current directory and scope. Ask about the people assigned to the engagement, not just the organisation's marketing. A qualification should sit alongside evidence that the team understands the service and can communicate useful findings.
Questions that reveal the proposed work
| Ask the provider | What a useful answer contains |
|---|---|
| Which parts of our business question will you assess? | Specific roles, functions and trust boundaries, with explicit exclusions |
| What experience does the assigned team have with this architecture? | Relevant work described without exposing another customer's confidential information |
| What preparation do you need from us? | Accounts, access, documentation, test data and named dependencies |
| What happens if access is not ready? | A plan for blocked time, rescheduling or revised scope, with commercial consequences explained |
| How do you notify us of an urgent finding? | An agreed channel, named recipient and expected response process |
| Can we see a suitably sanitised sample report? | Clear evidence, impact, recommendations and coverage limitations |
| How will the report be reviewed? | Technical and editorial review responsibilities |
| What is included after the report? | A readout, clarification period and explicit retest entitlement or quotation |
CREST's 2022 procurement guide treats supplier selection within a wider programme of preparation, testing and follow-up. Use it as background; the comparison below is an original example for a particular buying decision.
A worked comparison sheet
Fictional exercise: two proposals pass the essential conditions for the portal test. The buyer sets the following weights before evaluating the answers. Scores run from 0 (no usable evidence) to 3 (clear, relevant evidence).
| Criterion | Weight | Proposal A | Proposal B | Evidence behind the judgement |
|---|---|---|---|---|
| Relevant team experience | 30 | 2 | 3 | B identifies the assigned tester's comparable work; A provides only a broader team summary |
| Coverage and methodology | 30 | 3 | 2 | A maps every agreed user role; B needs clarification on the support role |
| Reporting and follow-up | 25 | 3 | 1 | A includes an example finding and scoped retest; B supplies only a report contents list |
| Delivery and communication | 15 | 2 | 3 | Both are credible; B gives a clearer cover arrangement |
Calculate each contribution as weight × score ÷ 3. A totals 85; B totals about 73.3. Those results are a record of this buyer's stated preferences, not an objective quality rating of real suppliers.
Ask B to clarify the omitted role and follow-up work before deciding. Re-score if the evidence changes. If the proposals cover different work, first align their scope; arithmetic cannot make an unequal comparison fair.
Compare the commercial assumptions
Record the effort allowed for preparation, hands-on testing, analysis, reporting and retesting. Note travel, access restrictions, blocked-day charges, cancellation terms and whether follow-up must happen within a particular window. Avoid equating person-days with quality, but understand what the price buys.
A proposal that requires you to arrange a complex test environment may be reasonable. The cost and lead time still belong in your decision. Confirm a realistic delivery date after accounting for that preparation.
Leave an auditable decision
Keep the final scope, the evidence used, clarifications, reasons for selection and agreed limitations together. Identify the internal person who will receive the report and own the findings.
Before signing off the engagement, read how to review a security-testing report. It is easier to agree useful deliverables before testing than to ask for them after the final invoice.
Sources and further reading
- NCSC CHECK: Information for buyers — checked 2 November 2026
- CREST: A Guide to Penetration Testing (December 2022) — checked 2 November 2026