Objective
Launch, customer requirement, audit, due diligence or periodic validation.
Buying guide
Hire penetration testing with a clear objective, coverage and delivery.
A guide to hiring penetration testing: objectives, scope, authorization, access, methodology, deliverables, retesting and how to compare proposals.
Scope checklist Comparison criteria Formal authorization
When this matters
A vague proposal produces mismatched expectations.
Before comparing vendors, your company needs to know which decision the test will support and which assets represent that need.
01
Define why you are buying the test
02
List the relevant assets and roles
03
Document operational restrictions
04
Compare method, delivery and retesting
Checklist
What should be clear before you approve.
These points cut down on change orders, coverage gaps and disagreements at closure.
Scope
URLs, APIs, domains, IPs, networks, roles, integrations and exclusions.
Rules
Windows, contacts, limits, sensitive data and what happens in case of an incident.
Delivery
Technical report, executive summary, presentation, evidence and retesting.
Inside the delivery
See how this work takes shape.
From technical alignment to delivery, the work has to leave context, evidence and next steps visible to everyone involved.
01 / 04
Process
A predictable buying process.
Quality starts before the technical work does.
Bring the right people in
Include whoever knows the environment, whoever receives the delivery and whoever approves the test.
Describe the environment
Provide inventory, architecture, roles and any recent changes that matter.
Compare proposals
Weigh coverage, exclusions, method, experience, timeline, delivery and retesting.
Formalize the authorization
Make sure assets, period, limits and contacts are documented.
Deliverables
Criteria for assessing a vendor.
Price matters, but on its own it says nothing about depth or how usable the delivery will be.
Scope clarity
The proposal states exactly what will and will not be assessed.
Evidence quality
Findings should be reproducible and useful for remediation.
Communication and safety
There are named owners, evidence handling and a procedure for critical risk.
Frequently asked questions
Straight answers to help you plan the assessment.
If your question isn't here, talk to the team directly.
Ask on WhatsAppWhat information do I need to send?+
Objective, type and number of assets, technologies, authenticated areas, roles, target timeline and known restrictions are a good starting point.
How do I compare two proposals?+
Compare coverage, depth, exclusions, how findings are validated, deliverables, experience, retesting and execution terms — not just price.
Are a contract and authorization required?+
Yes. The work has to run under formal authorization, with the scope and rules of engagement documented.
Next step
Want to turn your inventory into a concrete scope?
Fill in what you have; our team comes back with questions and a proposal.