Buying penetration testing services

Start with the decision you need to make

Before requesting a penetration testing quotation, explain why the test is needed. You may be preparing to launch an application, checking an important change or responding to a customer assurance request. The objective determines which systems and activities belong in the engagement.

Our penetration testing service covers agreed networks, applications and cloud environments. Use the initial discussion to establish which of these is relevant to your organisation.

Compare the same scope

Two quotations can describe penetration testing while covering very different work. Ask each provider to identify the systems, environments and user roles included, the access they require and the time allocated to testing. An application with several permission levels may need a different approach from a public website with no login.

Clarify what is excluded. A test of an application does not automatically include its hosting configuration, every connected supplier or staff awareness. Request written authorisation from the appropriate owners and agree restrictions before testing starts.

Understand the cost factors

System complexity, the number of targets, available documentation and permitted testing hours can affect the work required. Reporting, meetings and retesting also take time. Ask whether these are included and how additional work would be approved.

For procurement, record your required delivery date and who will make the system available. A lower quotation may simply cover fewer systems or less testing time. Compare the proposed work before comparing the total.

Make the report useful

Ask for a report that identifies the tested scope and limitations, explains the impact of findings and gives your team a basis for prioritising repairs. Agree how urgent findings will be communicated and who may receive the final report.

After delivery, assign each action to an owner. Confirm whether retesting is included, what it covers and how its result will be recorded. A completed test is evidence about an agreed scope at a particular time, not a promise that the organisation is secure indefinitely.

Prepare your enquiry

Bring a short system list, your objective, the intended deadline and any operating restrictions. Our assessment preparation guide explains what to gather. Keep credentials and sensitive technical records out of the website form.

Discuss your penetration testing scope. If you are still deciding where to start, the complimentary security assessment is available at no cost and can help you identify topics for discussion. It does not test your systems.

Further reading: NCSC guidance on commissioning penetration testing.