Ask these twelve questions on the scoping call. The answers will tell you more than any brochure.
1. Who specifically will perform the test, and can I see their CV?
Expect a named individual with hands-on offensive certifications and relevant sector experience. "One of our senior consultants" is not an answer — get the name written into the statement of work.
2. How many consultant-days does this quote include?
Expect a specific number. This is the single best way to compare quotes fairly.
3. What percentage of the testing is manual?
Expect 70 percent or more manual for an application test. Automated tooling should be used for coverage, not as the assessment.
4. Which methodology do you follow?
Expect a named standard: OWASP Web Security Testing Guide, OWASP API Security Top 10, OWASP MASVS for mobile, PTES or CREST for network work.
5. Can I see a redacted sample report?
Expect a yes, immediately. A refusal means the report is a scanner export.
6. How is severity determined?
Expect business impact plus exploitability in your specific context — not raw CVSS copied from a tool.
7. Is a retest included, and for how long after delivery?
Expect one retest within 30 to 90 days, included in the price.
8. Will you provide an attestation letter?
Expect yes. This is the one-page document you send to customers, insurers and auditors.
9. What happens if you find a critical vulnerability mid-test?
Expect immediate notification through an agreed channel, same day, with interim mitigation advice — not a surprise buried in a report three weeks later.
10. How do you handle our data?
Expect encrypted storage, a defined retention period, secure deletion on request, a signed NDA, and clarity on which jurisdiction the data sits in.
11. What do you need from us to start?
Expect a clear list: test accounts for every role, documentation, allowlisting, a named technical contact, and an authorisation letter. A vendor who needs nothing from you is not going to test anything deep.
12. What is explicitly out of scope?
Expect honesty. Denial-of-service, social engineering, physical intrusion and third-party SaaS platforms are usually excluded unless specifically contracted. Knowing what is not tested is as important as knowing what is.
Bonus question: what would you test first, and why?
This one is unscripted and reveals whether they thought about your business. A strong answer sounds like: "Your multi-tenant data model — with several roles sharing one database and a public API, broken object-level authorisation is statistically your highest-impact risk, so I would start by attempting cross-tenant access with a low-privilege token."
Answers that should end the conversation
- "We guarantee you will pass compliance."
- "We can start tomorrow without scoping."
- "Our platform does it all automatically."
- "Retesting is a separate purchase."
- "We cannot share the tester's background for confidentiality reasons."
---
Need a second opinion on your security posture?
I'm Michael Adeyanju, a penetration tester and security consultant working with companies globally — web app, API, mobile and network security. Based in Lagos, Nigeria, available for remote and on-site engagements worldwide.
Book a 15-minute call: cal.com/michaeladeyanju/15min
See what an engagement covers: michaeladeyanju.com/security-engineer