Written By Midhlaj
June 23rd,2024
Which certifications are held by your specialists?
Before choosing a pentesting provider, ask about their specialists' certifications (e.g., CEH, CISSP, OSCP) to gauge their expertise.
What is your own internal security like?
Ensure the pentest report's confidentiality and security by asking about data protection measures and preferred delivery methods.
Will your tests impact our usual operations?
Choose a pentest provider that mitigates testing impacts, avoids disruptions, and safely exploits vulnerabilities without harming your system.
Do you outsource your projects?
Choose a pentesting company that does not outsource work to ensure confidentiality, accountability, and consistency in handling sensitive data.
What does your report cover?
A thorough pentest report includes an executive summary, detailed vulnerabilities with replication steps, recommendations, and risk scores for prioritization.
Will you help me fix my vulnerabilities?
Hire a pentesting company that offers actionable recommendations, post-test support, and re-tests to ensure vulnerabilities are fixed.
How much of your testing is manual versus automated?
Choose pentesters with 80% manual testing for deep, creative vulnerability assessment. Look for enthusiastic experts who ask insightful questions.
What tools will you be using?
Choose pentesters who focus on the process, not just tools. Look for detailed answers about tools like BurpSuite, Nmap, or MetaSploit, showing deep understanding.
How do you approach a penetration test?
Choose a firm with a clear methodology: reconnaissance, scanning, exploitation, and post-exploitation. Look for intelligence-driven processes.
How will you be reporting your findings?
A mature security practice requests emergency contacts, sets communication frequency, uses secure methods like encrypted email, and executive-level reports.