Twelve questions to ask a penetration testing vendor

Penetration testing proposals tend to look the same: a methodology diagram, a list of frameworks, a price. The differences that matter are in how the work is done and who does it, and those rarely appear on the proposal. These twelve questions surface them. Ask them on the scoping call, and pay attention to how directly they are answered.

About the people

1. Who will actually perform the test? Ask for names. Many firms sell the engagement and subcontract the testing, sometimes offshore, to people you will never speak to. You want to know that the person scoping the work is the person doing it, and that you can talk to them afterward.

2. What is their background, and what have they tested that resembles our environment? A tester who has only done external network scans is not the right choice for an authenticated multi-tenant application or an AI agent. Ask for relevant experience, not certifications alone.

3. Can we speak to a reference client? A firm doing good work has clients willing to say so.

About the work

4. How much of the engagement is manual testing versus automated scanning? Automated tools are part of every engagement. They are not the engagement. If the answer is vague, or the price seems too low for the scope, the deliverable is probably scanner output with a cover page.

5. How do you validate findings? A real finding has been investigated and, where safe and authorized, exploited to demonstrate impact. Ask how they confirm that a vulnerability is actually exploitable in your environment rather than reporting everything the scanner flagged.

6. How do you handle sensitive data you encounter during testing? If the tester gains access to a database of customer records, what do they do? The right answer involves proving access without extracting data, capturing minimal evidence, and storing it encrypted. The wrong answer is a screenshot of your customer table in the report.

7. What happens if you discover an active compromise? Testers sometimes find evidence that someone else got there first. Ask what the procedure is. The right answer is: stop, notify your escalation contact immediately, and follow an agreed process.

8. How will you coordinate with our IT team, and what are the rules of engagement? Authorized targets, testing windows, exclusions, communication contacts, and escalation arrangements should all be agreed in writing before testing starts. A firm that waves this off is a firm that will take down your production system at 2pm on a Tuesday.

About the deliverable

9. Can we see a sanitized sample report? This is the single most useful question. Look for scope and limitations, severity rated in environmental context rather than copied from CVSS, evidence for every finding, specific remediation guidance, and an executive summary a non-engineer can read. Our article on what a good penetration test report looks like goes through each element.

10. Is a live debrief included? The debrief is where the context lives. The tester should walk your technical and leadership teams through the findings, the evidence, the limitations, and the practical priorities.

11. Is a retest of remediated findings included, and at what price? Findings are not closed until they are retested. Retest should be part of the engagement, not an add-on discovered after the invoice.

About the fit

12. Will this satisfy our auditor, insurer, or customer? Share the specific request. A good vendor will scope the test to produce the evidence that request needs and will be honest that testing does not itself certify compliance or guarantee a third party’s acceptance. A vendor that promises your auditor will accept it sight unseen is promising something they cannot deliver.

What good answers sound like

Direct, specific, and unbothered by the question. A firm that does its own testing, validates its findings, protects your data, and stands behind its report will answer all twelve without hesitation. A firm that does not will get vague around questions 1, 4, 6, and 9.

Sidechain performs every penetration test in-house, and we are happy to answer all twelve on your scoping call. Our methodology and engagement security pages cover most of them in advance.