How to Select the Right Security Testing Provider
A comprehensive guide to evaluating and selecting security testing providers. Learn what certifications, experience, and credentials to look for.
Why Provider Selection Matters
Choosing the right security testing provider is one of the most important decisions in your security program. A skilled provider will identify critical vulnerabilities that could prevent a breach, while an inadequate one might give you false confidence.
Key Criteria for Evaluation
1. Certifications and Credentials
Look for providers whose team members hold recognized industry certifications:
- OSCP (Offensive Security Certified Professional) — The gold standard for penetration testing
- CREST — Widely recognized in the UK and internationally
- CEH (Certified Ethical Hacker) — A good baseline certification
- GPEN (GIAC Penetration Tester) — Strong technical assessment certification
- OSCE/OSWE — Advanced offensive security certifications
2. Relevant Experience
- Do they have experience in your industry?
- Have they tested similar technologies and architectures?
- Can they provide redacted sample reports?
- Do they have case studies or testimonials from similar organizations?
3. Methodology
A reputable provider should follow a recognized methodology: - OWASP Testing Guide for web application testing - PTES (Penetration Testing Execution Standard) - NIST SP 800-115 Technical Guide to Information Security Testing
4. Communication and Reporting
- How frequently do they provide updates during an engagement?
- What does their report format look like?
- Do they provide remediation guidance with their findings?
- Are they available for post-engagement questions?
5. Insurance and Legal Compliance
- Do they carry professional liability insurance?
- Are they willing to sign NDAs and work within your legal framework?
- Do they have a clear rules of engagement process?
Red Flags to Watch For
- Providers who guarantee they'll find vulnerabilities (no one can guarantee this)
- Unusually low pricing that suggests automated scanning only
- Inability to provide references or sample reports
- Lack of formal methodology or process documentation
- No clear communication plan or escalation procedures
Making Your Decision
Create a scoring matrix based on the criteria above, weight each factor by importance to your organization, and evaluate at least 3 providers before making a decision. Remember: the cheapest option is rarely the best value.