Buyer's Guide · Last updated: September 23, 2026

What to actually look for when choosing a penetration testing provider

Penetration testing is an unregulated market – technically, anyone can call themselves a “pentester”. This guide summarizes what serious sources (BSI, OWASP, CREST) and the industry itself use to evaluate providers – with sources, without a vendor ranking.

13 selection criteria Scoring matrix Contract & law (Germany)

By Florian Schüssler · Former Criminal Police Investigator · Lecturer at DHBW Stuttgart

TL;DR

Before you request quotes, settle three decisions yourself: test depth (scan, pentest or red team), level of information (black, grey or white box) and goal (evidence for an auditor or a real risk picture). A credible pentest is mostly manual work by certified testers, follows a named methodology, includes a retest and delivers a report with reproduction steps. No test starts without written authorization from the system owner and agreed rules of engagement.

Before the first quote

Three decisions you have to make yourselves

They determine effort, price and the type of provider that fits. Leave them to the provider and you get whatever the provider prefers to sell.

Decision 1 · Test depth
Vulnerability scan

Automated and signature based. Finds known flaws in known products, but no logic errors and no chained attacks. Useful as a continuous service, not a substitute for a test.

Penetration testDefault

Manual testing of a defined scope in a fixed time window. Testers chain vulnerabilities into attack paths and back every finding with a proof of concept.

Red team

Objective driven rather than scope driven: a simulated attacker works for weeks against your detection and response. More expensive, and only worthwhile once monitoring and incident response are in place.

Decision 2 · Level of information
Black box

The tester knows only what an outsider knows. Realistic, but a large share of the test days goes into reconnaissance instead of depth.

Grey boxDefault

Test access and basic information, such as a user account and a network diagram. Best ratio of depth to cost, which is why it is the standard for most projects.

White box

Source code, architecture, admin access. Finds the most per test day, but says little about how far a real attacker would get.

Decision 3 · Goal
Evidence for an auditor or customer

You need a document for ISO 27001, TISAX, NIS2 or a customer requirement. Narrow scope, formal report, often a deadline. The provider has to know the target format and should have delivered reports for exactly this purpose before.

A real risk picture

You want to know how far an attacker would get. Realistic scope, escalation between systems, more test days. Needs a provider that actually chains findings instead of stopping at the first one per system.

Process

How a credible pentest runs

Based on the five-phase model of the BSI implementation concept, plus the retest. A provider who cannot describe one of these phases in the quote usually has not planned for it.

  1. 01

    Scoping and authorization

    Targets, exclusions, test windows, emergency contacts and written approval from the system owner. Without a scoping call there is no reliable quote.

  2. 02

    Information gathering

    OSINT, port scans, technology fingerprinting, documentation of the attack surface. This is where automation belongs.

  3. 03

    Vulnerability analysis

    mostly manual

    Scanner output is verified and rated by hand. This is where a pentest parts ways with a scan: false positives go out, business logic comes in.

  4. 04

    Active attacks

    mostly manual

    Findings are exploited and chained towards the agreed objective: data access, privilege escalation, movement between systems. Critical findings are reported immediately, not in the final report.

  5. 05

    Report and debrief

    Management summary, technical findings with reproduction steps, risk rating and prioritized measures. Ideally two sessions: one for IT, one for management.

  6. 06

    Retest

    After remediation the provider checks the reported vulnerabilities again and confirms the result in writing. Only then is the project complete.

The Criteria

13 things that actually matter

Compiled from the BSI methodology, OWASP, the CREST standard, and the selection criteria used by credible providers across the DACH region and internationally.

01

Manual testing depth, not just a scanner Non-negotiable

A real pentest is mostly manual work – automated scanning is only the starting point. Business logic flaws, chained attack paths, and access-control gaps are found by humans, not tools. How to check: ask for the manual-vs-automated ratio, request concrete business-logic examples from past engagements, and ask for a redacted sample report with real proof-of-concept evidence, not just a CVSS list.

02

Certifications of the individual testers Non-negotiable

Since “pentester” is not a protected title, hands-on certifications (OSCP, OSEP, OSWE, CRTO, CRTP) are the most important screening criterion – not the company's certifications, but those of the people who will actually run your test. How to check: ask for the certifications of the specifically assigned testers and request proof (e.g. via Credly).

03

Recognized methodology, not a tool list Non-negotiable

Credible providers follow documented standards such as the BSI study “Durchführungskonzept für Penetrationstests”, OWASP WSTG, PTES, or NIST SP 800-115. If only a tool list (Burp, Nmap, Metasploit) is presented as “methodology”, that is marketing, not a process. How to check: explicitly ask in the quote for the underlying framework.

The rest of the checklist

04

Report quality

You are paying for the analysis, not the automation output. A good report contains a management summary, technical findings with reproduction steps and screenshots, a risk assessment, and prioritized recommendations – separated by audience (management vs. IT). How to check: request an anonymized sample report before signing.

05

Included retest

A pentest without a retest is a diagnosis without a follow-up – whether a vulnerability was actually fixed remains unverified. How to check: clarify upfront whether the retest is included or billed separately (in our experience, a retest that is not included typically adds 20–30% of the project volume).

06

Clear scoping & rules of engagement

Targets, exclusions, test windows, and escalation paths must be documented before testing begins – without documented authorization (“permission to attack”), a test is on thin legal ice. How to check: a credible provider insists on a scoping call. No scoping call before the quote is a warning sign.

07

References & track record

Verifiable security research, publications, or reference clients of similar size and industry demonstrate real reputation within the professional community. How to check: ask specifically for case studies or published advisories – and whether a reference from your industry exists.

08

Professional / cyber liability insurance

Intrusive tests can unintentionally impact production systems – professional liability insurance with an explicit pentest clause covers this risk. In our experience, coverage of around €5 million is common. How to check: request proof of insurance with a clause covering offensive security activities.

09

Data location & no offshore subcontractors

Who actually tests – employees or anonymous subcontractors? For GDPR, NIS2, and DORA it matters where data is stored and processed. How to check: ask about the employment status of testers, potential subcontractors, and the location of data storage (ideally EU).

10

Independence

A provider that also sells security products has a structural conflict of interest when assessing your risks. How to check: ask whether the provider distributes hardware or software that they might “recommend” as part of the test.

11

Technical specialization

Web/API, Active Directory, cloud, mobile, or OT/ICS each require different expertise – a generalist is rarely equally strong in all areas. How to check: request proof of experience with your specific tech stack and industry.

12

Regulatory fit

Depending on your industry, NIS2, DORA/TLPT, KRITIS (sections 30, 31 BSIG), TISAX, or ISO 27001 may require specific evidence – not every provider fits every regulatory context. How to check: verify whether the provider has experience with your specific regulatory framework, and whether they are BSI-listed or CREST-accredited if relevant.

13

Price transparency

A credible quote is a binding fixed price after a scoping call – with a transparent breakdown by test days. Pricing per IP address or per scan result usually indicates automated scanner billing. How to check: request a transparent breakdown instead of a lump sum.

Scoring matrix

How to compare concrete quotes

Score each criterion 0, 1 or 2 points and add them up. The matrix does not replace a conversation, but it shows where a quote stays silent.

Criterion 0 points 1 point 2 points
01Manual shareNot quantified or evasiveQuantified, no examplesQuantified, with business-logic examples and a sample report
02Tester certificationsCompany certifications onlyCertifications named, testers notCertifications of the assigned testers, with proof
03MethodologyTool listFramework namedFramework with version, adapted to your scope
04ReportNo sample availableSample without reproduction stepsAnonymized report with proof of concept, summary and measures
05RetestNot mentionedAt extra costIncluded, with deadline and scope
06Scoping and rules of engagementFixed price without a callA call, but nothing in writingScoping call and written rules of engagement
07ReferencesNoneGeneral referencesReference from your industry or published research
08InsuranceNo proofLiability insurance without pentest clauseProof with a clause for offensive testing
09Data location and testersUnclear, or subcontractors in third countriesEU, employment status unclearStored in the EU, employed and named testers
10IndependenceSells products it recommends in the reportSells products, discloses itNo product sales
11SpecializationNo relation to your stackGeneral experienceDocumented experience with your stack
12Regulatory fitDoes not know your frameworkKnows itHas already delivered evidence for it
13Price transparencyLump sum or price per IPFixed price without breakdownFixed price with person days per phase

Reading it: 22 to 26 points is a solid quote. 15 to 21 means ask questions, usually solvable. Below 15, or a zero on any of the first three criteria: keep looking.

Understanding certifications

Which pentester certifications actually matter?

A rough tiering by hands-on rigor – not exhaustive, but a good first filter when a provider lists certifications.

Entry level
CEH · CompTIA PenTest+ · eJPT

Demonstrate foundational knowledge, often with a high multiple-choice component (CEH). On their own, not strong evidence of practical compromise capability.

Most commonly required Advanced
OSCP · CRTO · CRTP · CPTS · GPEN

OSCP is considered the de-facto industry standard – a hands-on exam of 23 hours 45 minutes, followed by 24 hours to submit the report. Candidates passing since November 2024 also receive the OSCP+, which must be renewed after three years. CRTO/CRTP are the common entry points into red teaming. Most frequently required in pentester job postings.

Elite
OSEP · OSWE · OSCE3 · OSEE · CREST CCT

Advanced specializations (advanced evasion, web whitebox, exploit development) with multi-day practical exams. Separately from its individual certifications, CREST also accredits companies, assessing the provider’s processes, quality assurance and information security.

Note: CISSP is widely considered of limited relevance for hands-on pentesting – it is a management certification without a mandatory practical component.

Company level

Personal certifications answer whether the tester sitting at your systems is any good. Company certifications answer whether the provider is organizationally sound. You need both; the first matters more.

BSI list of certified IS penetration testing providers

The German BSI certifies companies for the scope “IS penetration tests”; it reviews the approach, quality assurance and the competence of the employed testers. The list is public and a solid anchor, especially for public authorities and critical infrastructure operators. It is not a measure of completeness, though: many specialized providers never applied, and a listing says nothing about the testers your project will actually get.

View the BSI list ↗

CREST accreditation

A UK-rooted accreditation scheme that couples company processes, liability insurance and personal certifications. Widespread internationally; in Germany mostly found with larger or internationally active providers.

The provider's own ISO 27001

Shows that the provider manages its own information security, meaning your test data and reports are handled in an orderly way. It says nothing about the quality of the testing.

Warning signs

9 red flags when choosing a provider

None of these signals is a deal-breaker on its own – but in combination, they warrant closer questioning.

  • Automated scan sold as a “pentest”: no proof of concept, no screenshots in the report, just a CVSS list without context.
  • Fixed-price quote without a prior scoping call, often combined with an unrealistically short turnaround (24 hours for a complete test).
  • Pricing per IP address or per scan result – a typical pattern for automated tooling rather than manual work.
  • No sample report available on request – you are buying a deliverable you have never seen before signing.
  • Unusually low price compared to the market average – often indicates pure tool automation or inexperienced testers.
  • No discoverable reputation in the security community – no research publications, no conference talks, no references.
  • Critical findings are reported in the final report instead of immediately. An open vulnerability stays known and untreated for weeks.
  • The testers stay anonymous. The provider names neither the people who will actually test nor their certifications, or swaps them after signing.
  • No written authorization document and no rules of engagement – the provider wants to “just get started”.

Looking specifically for a physical pentest provider?

Physical penetration testing is even less standardized than cyber pentesting – with its own criteria, its own certification landscape, and its own legal framework.

Go to the physical pentest buyer's guide →
Price ranges

What a pentest realistically costs (DACH, 2025/2026)

Reference values from multiple market sources (see references) – actual costs depend heavily on scope and testing depth. Quotes well below these ranges warrant closer questioning (see red flags).

Web application pentestapprox. €3,000 – 10,000
Infrastructure / network pentestapprox. €3,000 – 20,000
Daily rate, certified pentesterapprox. €1,200 – 2,000
Red team engagementfrom approx. €30,000
DORA TLPT cycle (financial entities designated by the supervisor, market estimate)approx. €200,000 – 620,000

Sources include market surveys and provider disclosures, see references. The TLPT range is a market estimate, not a figure from the supervisors. Not a substitute for an individual quote after a scoping call.

Why the lower daily rate is often the more expensive quote

A worked example with three fictional quotes for the same scope. Only quotes that disclose person days per phase and included services can be compared.

Quote Daily rate Person days of which manual analysis and attacks Retest Total
A€1,100105included€11,000
B€1,50065included€9,000
CLump sumnot statednot statedon request€4,900

A and B deliver the same five days of manual work. A spends five more days on reconnaissance and scanning that B automates, so A is more expensive and not better. C cannot be placed at all, and that is the finding: without a breakdown you are comparing prices, not services.

Contract and law

What has to be in writing before the first packet

Legally, a pentest is an attack with permission. These five points belong in every contract, whatever the size of the project.

§ 202a–c StGB

Authorization by the entitled party

Under German criminal law, accessing and intercepting data are offences (§§ 202a, 202b StGB). A commissioned pentest does not fall under them, because with the entitled party’s consent the tester is not acting “without authorization”. § 202c StGB on preparatory acts does not apply either: programs that are merely suitable for attacks (dual-use tools) are outside its scope, and anyone obtaining tools for a commissioned test is pursuing a lawful purpose (Federal Constitutional Court, 2 BvR 2233/07). Consent must come from a person with signing authority and must name the scope precisely: systems, IP ranges, time windows.

Third-party systems

Cloud, hosting, SaaS

You can only authorize what you own. Applications at a hoster or in a cloud are subject to that platform's rules for security testing; the major cloud providers allow tests of your own resources, not of the platform. Shared hosting and third-party SaaS products need the owner's explicit consent.

Art. 28 GDPR

Data processing and confidentiality

Testers almost always see personal data. That is why a data processing agreement, storage in the EU, a list of subcontractors, a deletion plan for test data, screenshots and the report, and a non-disclosure agreement belong in the contract.

RoE

Rules of engagement

Test windows, excluded systems, permitted techniques (denial of service usually not), handling of incidental findings on third-party systems, abort criteria, emergency contacts on both sides and immediate reporting of critical findings. One document, signed by both parties.

Liability

Liability limits and insurance

Intrusive tests can disrupt production systems. Under criminal law, the authorization only covers what it permits: deleting or altering data beyond that, or seriously disrupting data processing of substantial importance, can be prosecuted as data tampering or computer sabotage (§§ 303a, 303b StGB). Settle liability limits in the contract and ask to see proof of insurance with a clause covering offensive activities. For breaches of the rules of engagement the provider is fully liable; for damage within the agreed scope liability is usually capped.

This is general orientation, not legal advice. Have contract clauses, §§ 202a ff. and 303a f. StGB, and data protection questions reviewed by a lawyer for your specific case.

Regulatory context

When which framework becomes relevant

Depending on your industry and size, a specific provider certification or experience may be mandatory rather than optional:

NIS2 requires affected organizations to conduct regular security assessments. DORA/TLPT sets concrete requirements for testers (Art. 27 DORA) at the financial entities the supervisor designates for threat-led penetration testing: proven expertise in threat intelligence and red teaming, certification or a code of conduct, professional indemnity insurance. KRITIS operators (sections 30, 31 BSIG) need evidence for the BSI. TISAX is relevant for suppliers in the automotive industry. ISO 27001 requires technical vulnerability management (Control A.8.8) and security testing in development and acceptance (A.8.29), which can include pentests.

FAQ

Common questions about choosing a provider

OSCP is considered the de-facto industry standard and is the most commonly required certification in pentester job postings, because it is a hands-on exam of almost 24 hours with real system compromise and a subsequent report – not a multiple-choice test. Since November 2024 it comes with the OSCP+, valid for three years. But it is not the only relevant one: CRTO/CRTP are more common for red teaming, OSWE for web applications. What matters more than any single certification is whether the specifically assigned testers hold any hands-on credentials at all.

A pentest shows vulnerabilities at one point in time – whether your fixes actually work is only proven by a retest. Whether the retest is included is negotiable; what matters is that you clarify it upfront rather than being surprised by additional costs later. If billed separately, market norm is roughly 20–30% of the original project volume.

A vulnerability scan is an automated tool that identifies known vulnerabilities based on signatures – fast but shallow. A pentest combines this with manual analysis: testers chain multiple smaller vulnerabilities into real attack paths and test business logic that no scanner understands. When a pure scan is sold as a “pentest”, this manual component is typically what is missing – often recognizable by a report containing only CVSS scores without proof of concept.

Because scope, testing depth, and conditions directly determine the effort – a credible fixed-price quote without this call is either a rough estimate or in reality only covers an automated scan. The scoping call is also when rules of engagement and exclusions are defined, before any testing begins.

Not necessarily, but a price well below market ranges (see price ranges above) is a signal to ask more questions: What is the manual share, what certifications do the testers hold, is a retest included? Unusually low prices often result from heavy automation or inexperienced testers rather than genuine efficiency gains.

Legally not usually required, but practically relevant for GDPR, NIS2, and DORA: Where are test data and findings stored and processed, and who exactly performs the test – employees or anonymous subcontractors in third countries? For regulated industries (KRITIS, financial sector), a transparent EU-based provider is usually the simpler choice.

Still have questions about selection?

If you want to compare these criteria against a concrete quote – including ours – feel free to reach out. No obligation, no sales pressure.

Book a no-obligation call
Sources

What this guide is based on

This guide was compiled from publicly available professional sources. Where possible, we link to primary sources rather than competitor blogs.

Buyer's Guide · Last updated: September 23, 2026

Contact

Address
Albert-Einstein-Straße 1, 95028 Hof
E-Mail
hello@access-granted.de
Phone
+49 9281 5918506

AccessGranted X GmbH · HRB 7266 · Hof (Saale)

Company

Services

Regulatory pentests

Industries

Networks & trust seals
Trust Seal of the IT Security Association Germany (TeleTrusT)
Participant in the Alliance for Cyber Security
© AccessGranted X GmbH