Blogs

1. What’s a real attack scenario you’d specifically test for a business like ours?

Why it matters: this separates vendors who understand your industry from vendors running the same generic checklist on every client.

Good answer: they describe a specific business-logic scenario tied to your sector, such as a discount-code abuse path for e-commerce, a patient-record access flaw for health-tech, or a payment-flow manipulation for fintech.

Red flag: they immediately list generic vulnerability categories without connecting them to how your business actually operates.

2. Which testing methodology do you follow?

Why it matters: methodology determines depth and repeatability, not just a marketing checkbox.

Good answer: a named standard such as the OWASP Testing Guide or PTES, with a brief explanation of how it shapes their actual day-to-day process.

Red flag: a vague reference to industry best practices with no named framework behind it.

3. Can you share a sanitised sample report?

Why it matters: a sample report tells you more about a vendor’s actual output quality than any sales conversation will.

Good answer: they can send one within a day, and the methodology section actually describes what was tested rather than what could, in theory, be tested.

Red flag: reluctance, delay, or a report that is mostly marketing pages with a short findings list at the back.

4. What certifications do your individual testers hold, not just the company?

Why it matters: company-level accreditation does not guarantee the person testing your systems is individually qualified.

Good answer: named, verifiable individual certifications tied to the specific tester assigned to your engagement, not just a general company credential list.

Red flag: only company-level marketing claims, with no individual credentials offered.

5. Is the testing manual, automated, or both?

Why it matters: automated scanning alone misses business-logic flaws and chained vulnerabilities that only a human tester finds.

Good answer: automated tools are used for coverage, but manual testing is the core of the engagement, with a clear explanation of where a human takes over.

Red flag: heavy emphasis on tooling and dashboards, with little description of actual manual testing effort.

6. Is retesting included after we fix the issues you find?

Why it matters: a report full of unverified fixes is not proof that anything was actually resolved.

Good answer: retesting is built into the standard engagement rather than sold as a separate add-on. CyberSapiens, for example, includes a free remediation retest as part of every VAPT engagement.

Red flag: retesting is offered only as a new, separately priced engagement.

7. What is your pricing model, and what’s excluded?

Why it matters: the cheapest quote is often cheapest because it excludes manual testing depth, retesting, or a proper report.

Good answer: a clear breakdown of what is included, such as scoping, testing, reporting and retest, and what would trigger additional cost, such as scope changes or extra environments.

Red flag: a single flat number with no explanation of what is actually covered.

8. How do you avoid conflicts of interest if you also sell security tools or managed services?

Why it matters: a vendor selling you a firewall should not also be the one grading how well that firewall performs.

Good answer: a clear statement of independence, or a disclosure of any overlap and how it is managed.

Red flag: the question is brushed off as irrelevant.

9. How do you handle scope changes and safety during testing?

Why it matters: production environments need clear rules of engagement so testing does not cause an outage.

Good answer: a written rules-of-engagement document covering approved testing windows, environments, and an escalation process if something unexpected happens, in line with guidance such as NIST SP 800-115.

Red flag: no formal scoping document, with testing starting based on a verbal agreement only.

10. What happens if you find a critical vulnerability mid-test?

Why it matters: a critical finding sitting in a report you receive three weeks later is a critical finding an attacker had three weeks to find first.

Good answer: an immediate, real-time notification process for critical findings, kept separate from final report delivery.

Red flag: “you will see it in the final report,” with no mention of interim escalation.

If a vendor cannot produce something similar within a day of asking, that hesitation tells you more than their sales deck ever will.

How much should a penetration test cost?

It depends heavily on scope, but the price alone tells you less than what’s included in it. Use the pricing breakdown above to compare quotes on an apples-to-apples basis rather than by the headline number.

Should I always choose the vendor with the most certifications?

Certifications are a useful filter, but they matter most when held by the specific tester assigned to your engagement, not just listed as company credentials. A vendor with fewer but verified individual certifications is often a safer choice than one with a long company list and no named tester credentials.

Is an automated vulnerability scan the same as a penetration test?

No. An automated scan finds known vulnerabilities using tooling, while a penetration test includes manual testing that can uncover business-logic flaws and chained vulnerabilities automated tools are not designed to detect. A real penetration test should include both, with manual testing as the core of the engagement.

How long does a typical penetration test take?

This varies by scope, but a vendor should be able to give you a realistic range once they understand your environment, rather than a fixed number before any scoping conversation has happened.

What should I do if a vendor can’t answer these questions clearly?

Treat hesitation or vague answers as useful information. A vendor confident in their process should be able to answer all 10 questions specifically, without needing to check with someone else or deflect to a sales deck.

Ask us these 10 questions

We will answer every one of them, plus send you a real sample report before you decide anything. Our penetration testing services are built to hold up to exactly this kind of scrutiny.