Short answer: choose a penetration testing company that is CREST accredited (or an NCSC CHECK provider if you are in government, the public sector or critical national infrastructure), that agrees the scope in writing, whose quote states the tester days and the testers' qualifications, that is clear about how retesting is priced, and that can show you a sample report and offer a debrief. The NCSC says "the quality of a penetration test is closely linked to the abilities of the penetration testers involved" (NCSC), so check the people and the method, not just the brand.
Checked 29 October 2026.
What accreditations should a penetration testing company have?
- CREST Penetration Testing accreditation. CREST members "undergo rigorous audit and accreditation processes" and "sign enforceable Codes of Conduct and Ethics", and "All members feature on the CREST Marketplace" (CREST). You can look up any firm there and see which services it is accredited for.
- NCSC CHECK, if you are a central government department, public sector body or CNI organisation. The NCSC "recommends that HMG organisations use testers and companies which are part of the CHECK scheme" (NCSC). See CREST vs CHECK.
- Sector schemes where they apply: for example CBEST or STAR-FS for regulated financial services, or a PCI DSS QSA if card payments are in scope. Only ask for these if your regulator or contract requires them.
- Individual qualifications for the testers who will do your work, such as CREST Registered Penetration Tester (CRT).
- Company certifications such as ISO 9001 or ISO/IEC 27001 show how a firm runs itself. They are useful, but they are not a penetration testing accreditation.
How should the testing be done?
CREST describes penetration testing as "a variety of manual techniques supported by automated tools" and notes that it "is often confused with Vulnerability Assessment" (CREST). Ask each company to explain its methodology: how it scopes, what it tests, how it verifies findings and how it avoids disrupting live systems. A good answer is specific to your systems, not a generic checklist.
Human-led, automated and AI-assisted testing
Automated scanners and AI-assisted tools can cover a lot of ground quickly and can shorten turnaround. They do not replace skilled testers, who chain smaller weaknesses into real attack paths and judge business-logic and context-dependent issues. Whatever approach a company offers, ask:
- how much of the work is manual and how much is automated or AI-assisted
- how automated findings are checked by a person before they reach your report
- what the tools can access and how your data is handled
- whether you can choose the approach, for example fully human-led
What should the scope and quote include?
The NCSC says the output of scoping should be a document stating (NCSC):
- the technical boundaries of the test
- the types of test expected
- "the timeframe and the amount of effort necessary to deliver the testing - usually given in terms of resource days"
- the testing team's requirements, such as test accounts
- any compliance or legislative requirements the test must meet
- any reporting requirements, such as CVSS scores or CHECK severity levels
The NCSC also says scoping should involve risk owners, technical staff and a representative of the test team. If a quote has no tester days, you cannot compare it with another. To compare like with like, divide each price by its tester days.
How is retesting priced?
Providers price retesting in different ways: some include a retest, some charge a fixed fee and some scope it to the number of findings to re-verify. Ask how it is priced, what it covers and how long after the test you can book it, and get the answer in writing before you sign.
What should the report contain?
The NCSC says a penetration test report should include (NCSC):
- any security issues found
- the testers' assessment of the risk each vulnerability poses
- a way to fix each issue
- an opinion on the accuracy of your own vulnerability assessment
- advice on improving your internal vulnerability assessment process
It adds that "A debriefing can also be useful", where the testers run through their findings and you can ask questions. Ask every shortlisted company for an anonymised sample report and check that its findings are clear to both technical staff and management.
Questions to ask a penetration testing company
- Are you on the CREST Marketplace with Penetration Testing accreditation?
- Are you a CHECK provider, and do we need one?
- What qualifications do the testers on our test hold?
- Who will carry out the testing, and how will our data be handled?
- How many tester days is this quote, and what is the day rate?
- What exactly is in scope and out of scope?
- How much of the testing is manual, and how are automated or AI-assisted findings verified?
- How is retesting scoped and priced, and within what period?
- Can we see a sample report?
- Is there a debrief meeting after the report?
- How will you contact us if you find a critical issue during testing? The NCSC advises keeping a technical contact available "at all times" during the test.
- How quickly will we get the report?
Red flags
- No tester days in the quote, or a price that looks too low for the scope.
- A scan sold as a pen test. An automated scan has value, but it is not a penetration test.
- No named accreditation that you can verify on a public register.
- No scoping conversation before the price.
- Vague answers about who will test, how findings are verified or how retesting is priced.
- No sample report or no offer of a debrief.
Where does Samurai Security fit?
Samurai Security publishes this guide. We are CREST accredited for Penetration Testing (CREST Marketplace) and an NCSC Assured Cyber Security Consultancy. If you would like to put these questions to us, see an indicative price with our penetration testing cost calculator or book a scoping call.
Frequently asked questions
What is the most important thing when choosing a penetration testing company? The skill of the testers. The NCSC says the quality of a penetration test is closely linked to the abilities of the testers involved, so check their qualifications and the firm’s accreditation.
Should a penetration testing company be CREST accredited? For most UK organisations, yes. CREST members are audited, sign enforceable codes of conduct and appear on the public CREST Marketplace, so you can check them.
Do I need a CHECK provider? Only if you are a central government department, public sector body or critical national infrastructure organisation, or a contract requires it.
What should be in a penetration testing quote? The scope, the types of test, the number of tester days, the testers’ qualifications, how retesting is priced and the reporting you will receive.
Is an automated scan the same as a penetration test? No. CREST describes penetration testing as manual techniques supported by automated tools, and notes it is often confused with vulnerability assessment.
How should retesting be priced? It varies by provider: included, a fixed fee, or scoped to the findings to re-verify. Ask before you sign and get the answer in writing.
Sources
All checked 29 October 2026.