Finding the Right Penetration Testing Company
Melisa Wachs has been with the Black Hills Information Security (BHIS) administrative team since the company’s origin in 2008. She serves as the Director with a variety of roles including business capture, client relations, human resources, and report editing.
This blog is for anyone who is interested in finding a good penetration testing company. Those on the “sales” team may also find common ground below.
It’s been an exciting 17 years here at BHIS, and I’ve seen several industry trends come and go. As a whole, I feel the field has gained respect and understanding as penetration testers evolved from being viewed as “smelly, deviant hackers” to more “professional, trusted partners.” In the past, we frequently needed meetings with C-Suite executives explaining what we do in order to separate the stigma away from hacking to security—we even had a whole slide deck just for this purpose. It’s now been years since we’ve had to jump on a call with senior leadership to smooth over tensions surrounding proposed work.
Since 2008, I’ve been on the receiving (sales) end of BHIS, and I’ve often wanted to share tips to potential clients for the best way to get a fast, accurate quote at the best price. So as we move into 2026, I’ve written down some of my biggest insights on how to gather bids, determine the quality of testing firms, and get the best pricing for your engagement.
Please note that is not an exhaustive list but a focus on the biggest pain points that I often see with potential clients.
Bidding/Gaining Quotes
Our typical bidding process at BHIS includes an initial call for new customers, with a formal quote provided by week’s end, if not same-day. Unusual or non-standard environments may require a consultation with one of our testers, which may add a week or so. Other companies may provide different expectations, so clearly outline the timeframe of your internal decision process so that all can respond in a timely fashion.
- Start early for RFP processes. If you need to go through a formal or rigorous Request-for-Proposal (RFP) process, consider scheduling a call to clarify your needs. I can’t express the difference it makes to know that you’re willing to talk through scope within an RFP, as well as give our team enough time to jump through the extra hoops. If your RFP is “blind reviewed” where we can’t talk and is to be submitted on a portal… well, my heart just breaks.
- Work through legal right away. Begin Master Service Agreement (MSA) reviews early as revisions can be extensive. If your legal process is typically backed up, just know that this will slow things down. We can start working the MSA from your paper but will need time to add our essentials to your document.
- Allow adequate time for larger scopes. A larger scope of work will take more testers, time, and planning, so allow for more time to find a vendor.
- Minimize excessive paperwork. Don’t be overbearing with several security Q/A over multiple tabs. If a penetration testing company has a SOC 2 Type II and an annual Letter of Attestation for a penetration test from a 3rd party, they’ve done their due diligence. You may not always be able to bypass this process (especially in very large corporations), but you may also find yourself with fewer bidders at higher prices when requiring these added stipulations.
Evaluating Quality
- Align internal expectations before beginning vendor calls. Determine the difference between management’s concerns vs technical resource concerns and try to get on the same page for a unified goal. It’s always troubling when one team wants to “prove” something to another, or when we get on a Rules of Engagement call with a technical team who are clueless about what management hired us to do. Please don’t put a testing firm in the middle of your internal politics
- Compare bids accurately—Are you comparing apples to apples? Ask for hourly rate, bottom line, and the days/hours allocated. You should clearly be able to see how much time you are purchasing. Some services may be target bound rather than timebound, so gain clarity on how your project was scoped. If a customer says our bid for a large, complicated service was at half the cost, I often confirm the scope details with a mature tester and provide our hourly rate for utmost transparency. If you see a large discrepancy in pricing, ask questions and dig deeper.
- Ask if a company double-books, i.e. runs more than one test at a time. This is a red flag, especially during Q4. If a pentest company is willing to get you in quickly at an extra cost, they’re likely over-booking a penetration tester. On paper, this may make everyone happy if you have the budget to pay, but your tester may be burnt out and their attention will certainly be divided. Even when we’re tempted to make the extra revenue, it’s not worth having our testers burn out and leave. Find a company that treats their testers right. I also recommend asking if your tester(s) are full-time employees or sub-contractors. This may not be a determining factor on quality (as there are many qualified sub-contractors), but it may be something you’d like to consider.
- Ask for tailored recommendations based on the maturity of your company and your goals. For more on this, see the Pyramid of Penetration Testing Pain. You should feel that the vendor is trying to understand who you are, your concerns, and where you want to go as a company—not that you’re just getting a sales pitch.
- Consider rotating your testing companies. It’s not a bad idea, but if you love your current partner and want to stick with them, just ask for a fresh set of eyes by using different testers.
- Ask for recommendations from other organizations in your field. Nothing beats word-of-mouth.
- Ask for a sample report. Marketing can only lead you so far; at some point, you need to see the meat of what the report looks like. Ask for tester bios to get a feel for the quality of resources.
Securing Best Pricing
- Consider multi-year contracts to lock in pricing/timing. Traditional pentesting is a one-test-at-a-time operation (unlike our ANTISOC or SOC services), so having a customer lock in for multiple years is incentivized. Are you going to need an external and internal pentest in Q2 for the next 3 years? A long-term partner is music to my ears! No legal—just quick routing to scheduling for multiple years will get our attention for good pricing options.
- Be honest about your situation and budget. If you’re a non-profit with a tight budget, just talk to us. We’ll likely be able to extend a discount, especially if you’re flexible on scheduling.
- Ask for Q1 testing, especially in the first couple of weeks in January. You may cringe at the thought of being ready for a pentest right after the holidays, but if you’re on a budget and have flexibility of testing, I guarantee you January will yield good prices.
- Bundle services. At BHIS, the absolute best price for services is when a customer is both an ANTISOC (Continuous Penetration Testing) customer, and/or a SOC customer who wants traditional pentesting as well. We’re very excited about these engagements. To keep one team blind to the testing of another team internally is always fun, and we walk away with insight on how we can improve each branch. We look at this as a “sharpening iron with iron” situation, and this is where the absolute best pricing lives.
Ready to learn more?
Level up your skills with affordable classes from Antisyphon!
Pay-Forward-What-You-Can Training
Available live/virtual and on-demand
