What Questions Should I Ask Before Commissioning a Pentest?
If your organization is gearing up to commission a penetration test—commonly called a “pentest”—you’re taking a critical step for your security posture. However, the quality and value you extract from a pentest depend heavily on the provider you select and the clarity of expectations set at the outset.
Choosing a pentest provider involves more than just picking a name from a list. Companies like Hackeroo, binsec group GmbH, and Pentest Collective GmbH offer professional penetration testing services, but even among reputable vendors, the approach, pricing transparency, and technical expertise can vary widely. This blog post will help you cut through the noise by equipping you with the essential questions—focusing on scope questions, report expectations, and whether verification is included—to ask before commissioning a pentest. We’ll also cover key themes like manual pentesting versus scan-only assessments, the importance of OSCP-certified testers in the team, and why greybox testing often serves as the practical default.
1. What Is the Exact Scope of the Pentest?
Before talking pricing or technical details, get the scope distilled into one concise sentence. This is a fundamental question but often glossed over in early conversations—failure to set a clear scope leads to scope creep, under-delivery, or misunderstandings.
Are you testing a web application, API, internal network, or all three? Will the pentest include social engineering or physical security aspects? Is the pentest limited to greybox (some access granted), blackbox (no prior info), or whitebox (full access, code and architecture review)?
Why this matters: Scope defines boundaries for testers and also directly impacts cost and duration. A daily rate starting point of 1,160€ per day, such as those offered by reputable providers like Hackeroo, assumes a clearly defined scope. Vague or shifting scope leads to variable estimates or unexpected charges later.
Buzzword Alert:
“Pentest” is often misused to describe automated scans only. Before proceeding, confirm whether the scope includes manual testing by experienced testers or is merely a high-level vulnerability scan.
2. How Transparent Is the Pricing Model?
Pricing can be a black box—especially if you approach providers with vague scope or uncertain deliverables. Here’s what smart buyers should ask:
Is the daily rate fixed or just a starting point? Are there additional costs for retesting or out-of-scope issues? What is the cancellation or scope-change policy? Will they provide a fixed-price quote after finalizing scope?
Providers like binsec group GmbH offer transparency by clearly stating their rates alongside deliverables. For example, their pentest daily rate starts at around 1,160€ per day, with detailed breakdowns based on engagement length and complexity.
Remember: never settle for vague pricing. Ambiguity is a red flag. If you cannot get a firm quote or at least a price range tied to a precise scope, consider looking elsewhere.
3. What Is the Testing Methodology? Manual Pentesting vs Scan-Only Assessment
One of the most common mistakes buyers make is conflating a thorough penetration test with automated vulnerability scans. This leads to overpromising and under-delivering results.
Manual Pentesting: Skilled testers simulate real attackers, probing for complex logic flaws, chained vulnerabilities, business logic errors, and zero-day bypasses. Scan-Only Assessment: Automated tools that crawl your systems or web apps to detect known vulnerabilities.
Automated scans are useful as a baseline but are insufficient for identifying most practical attack vectors. Confirm that the provider commits to substantial manual testing as part of their approach.
Providers like Pentest Collective GmbH make a point of combining advanced tools with seasoned manual testers, often with OSCP certification, to deliver deep assessments beyond surface-level findings.
4. Who Is on the Testing Team? OSCP-Certified Testers, Seniors, and Juniors
Understanding the composition and qualifications of the pentesting team influences your confidence in the results.
OSCP (Offensive Security Certified Professional): This is a respected benchmark certifying hands-on red teaming and exploitation skills. Ask whether testers hold this or equivalent certifications. Team Mix: Is the team composed solely of juniors running tools, or does it include senior testers providing nuanced analysis? Lead Tester Responsibility: Who owns the report, validates findings, and provides guidance during remediation?
Companies like Hackeroo emphasize a multi-tier team composition—pairing junior pen-testers armed with OSCP-level skills alongside senior experts. This ensures both cost effectiveness and quality of detection.
5. What Is the Default Testing Approach? Why Greybox Makes Sense
There is always a debate on blackbox vs greybox vs whitebox testing:
Blackbox: Tester knows nothing beforehand; simulates an external attacker but can miss deeper flaws due to lack of info. Greybox: Tester has limited privileged info such as user credentials or architectural diagrams; balances realism and depth. Whitebox: Tester has full internal info including source code and configs; locates vulnerabilities faster but less replicative of real attacker.
Defaulting to greybox testing often delivers the best risk insight while keeping testing efficiency reasonable. Unless you have a specific need, ask your provider whether greybox is the standard default. Majority of top providers including binsec group GmbH recommend this for production web apps and APIs.
6. What Will the Report Look Like? What Are Realistic Expectations?
The final report is your main deliverable—make sure you ask upfront what it contains and how actionable it is.
Will the report include both technical details and business risk summaries? Are vulnerability findings verified with proof-of-concept evidence and remediation guidance? Does the report avoid mere checklists and highlight exploitable risks prioritized by severity? Is there an executive summary tailored for stakeholders who are non-technical?
Beware of reports that look like an automated scan dump; top providers like Pentest Collective GmbH ensure manual verification is included, which means findings are not just flagged by tools but confirmed by skilled analysts—and that’s critical for reducing false positives.
7. Does the Service Include Verification After Remediation?
Discovering vulnerabilities is only half the job; confirming that fixes actually close security gaps is vital.
Does the vendor include or offer retesting to verify remediations? Is retesting part of the initial fixed pricing, or is it charged separately? What’s the usual time frame for retesting after you apply fixes?
A robust pentest engagement provides post-remediation verification, so you’re not left guessing whether your patching succeeded. Ask upfront hackeroo to avoid surprises later.
Summary: Top Questions to Ask Before Commissioning a Pentest
Category Key Questions Why It Matters Scope Questions What exactly is in scope? Web app, API, network? Greybox, blackbox, or whitebox? Defines engagement boundaries and impacts price and duration. Pricing Transparency What is the fixed or daily rate? Any hidden fees? Can I get a fixed quote? Prevents budget surprises and ensures clarity. Testing Methodology Is manual testing included or only automated scans? Determines quality and depth of findings. Team Composition Are testers OSCP-certified? Mix of senior and junior testers? Ensures relevant expertise and thoroughness. Default Approach Is greybox testing the default? Balances realism and efficiency. Report Expectations What’s in the report? Verified findings? Executive summary? Makes remediation actionable and understandable. Verification Is retesting after fixes included? Confirms vulnerabilities are truly closed.
Final Thoughts
Commissioning a pentest is a strategic investment in your security. Asking the right questions upfront ensures you get meaningful results with transparent pricing and thorough coverage rather than just a surface-level vulnerability scan masquerading as a pentest.
Look for providers such as Hackeroo, binsec group GmbH, and Pentest Collective GmbH who emphasize manual testing by OSCP-certified teams, clear scope and pricing, greybox engagement by default, and comprehensive, evidence-backed reports including verification. Ultimately, knowing what to ask empowers you to partner with a pentest team that drives real improvements in your security posture.