The five most important factors to consider when choosing a penetration testing provider. Available online and as a PDF download.
Check whether it is truly a manual penetration test or, if applicable, an automated vulnerability scan.
A penetration test always involves manual work by an experienced penetration tester. Automated scans are a good supplement and can serve as a basis for a penetration test. However, automated scans are no substitute for manual penetration tests conducted by an experienced expert.
What should be tested?
Should the test focus on individual, simple websites, or rather on infrastructure,
databases, or even complex web applications?
You should go through a questionnaire with the penetration testing provider to assess the scope in detail. Only on this basis can a reputable quote tailored to your needs be prepared.
What testing standards does the company follow? Does the penetration testing provider test exclusively for the OWASP Top 10, or is the scope broader?
OWASP WSTG is recommended.
Mobile applications: OWASP MSTG and/or OWASP ASVS.
Infrastructure penetration tests: Conducted using the MITRE ATT&CK framework.
You should request and review a sample penetration test report.
Does the company provide independent (context-based) assessments of the issues in its penetration testing report, in addition to the CVSS scores?
Does the penetration testing report also include recommendations, or does it merely list findings?
The penetration testing report should include information about what was specifically tested and not consist solely of anomalies.
Can the penetration testing provider explain the penetration testing process in a concrete and straightforward manner?
Recommended hands-on certifications:
Offensive Security (OSCP, OSWE, OSEP)
Hack The Box CPTS
eLearningSecurity / INE Security (eJPT, eCPPT, eMAPT, eWPT)
BSI (IS Penetration Tester)
tryhackme / Hack The Box Profile
You can reach us by phone Monday through Friday from 8:00 a.m. to 6:00 p.m. to discuss your penetration testing needs.
Phone: +4921732653550
Feel free to send us an email—we usually respond within 24 hours.
kontakt(AT)apollon-security.com