Choosing a cybersecurity consulting firm comes down to five things: who does the actual work, how much of it is manual, what the report looks like, whether a retest is included, and whether they understand your business. Everything else is marketing.
Step 1 — Define what you actually need
Before you talk to anyone, write down one sentence: "We need X tested because Y." Common versions:
- We need our web app and API tested because an enterprise customer requires a third-party report.
- We need a cloud configuration review because we just migrated to AWS.
- We need ongoing advisory because we ship weekly and have no security engineer.
- We need a mobile app assessment because we are launching on the app stores next quarter.
The wrong firm for one of these is the right firm for another.
Step 2 — Evaluate the consultant, not the company
Ask for the CV of the person who will run your engagement. Look for hands-on offensive certifications (OSCP, OSWE, CREST CRT, eWPTX), public research or CVEs, bug bounty track record, and experience in your sector. A large firm may sell you a partner and staff you with a junior — get the named consultant in the statement of work.
Step 3 — Insist on manual testing
Ask directly: what percentage of this engagement is manual? Automated scanners find missing headers and known CVEs. Humans find broken access control, tenant isolation failures, business logic flaws and chained exploits — which is where actual breaches come from. If the answer is vague, walk.
Step 4 — Read a sample report
A redacted sample tells you almost everything. Look for:
- An executive summary a non-technical director can act on.
- Severity based on business impact, not raw CVSS.
- Reproduction steps precise enough for an engineer to follow without help.
- Specific remediation advice, not generic OWASP links.
- Evidence — screenshots, requests and responses.
Step 5 — Check scope and methodology
The proposal should name a methodology (OWASP WSTG, OWASP API Top 10, MASVS for mobile, PTES) and list the number of consultant-days. Vague scope is how quotes get padded and how findings get missed.
Step 6 — Confirm the commercial basics
- Retest included, and for how long after delivery?
- Attestation letter for customers and auditors?
- Liability insurance and a signed NDA?
- Data handling: where is your report stored, for how long, and how is it destroyed?
- Communication: a shared channel for critical findings during testing, not a surprise on delivery day.
Step 7 — Judge the conversation itself
The best signal is the scoping call. A good consultant asks about your business model, your most sensitive data, your riskiest workflow and your worst-case scenario. A poor one asks only for the number of URLs.
Red flags
- Guaranteed "compliance pass" or promises of zero findings.
- No named consultant.
- Pricing given before scoping.
- Scan output rebranded as a penetration test.
- No retest, no attestation, no sample report.
- Pressure to sign this week for a discount.
Boutique versus big firm
Large firms bring brand recognition that some procurement teams require, and breadth across many disciplines. Independent consultants and small teams typically give you a senior tester doing the work directly, faster scheduling, deeper engagement with your engineers, and a materially lower price for comparable technical quality. For most startups and mid-market companies, the second option wins on value — as long as you verify the individual's track record.
---
Need a second opinion on your security posture?
I'm Michael Adeyanju, a penetration tester and security consultant working with companies globally — web app, API, mobile and network security. Based in Lagos, Nigeria, available for remote and on-site engagements worldwide.
Book a 15-minute call: cal.com/michaeladeyanju/15min
See what an engagement covers: michaeladeyanju.com/security-engineer