Published · By the Aesparrow Security Research Team
Short answer
Choose a VAPT company that uses certified testers (such as OSCP or CEH), follows a documented manual methodology (PTES, NIST SP 800-115, OWASP), shows a sample report with CVSS-scored, reproducible findings, includes re-testing, maps results to your compliance frameworks, and has clear data-handling and legal authorisation processes.
What questions should you ask a VAPT provider?
- Who will test?: names, certifications and experience of the actual testers.
- How much is manual?: avoid providers who resell scanner output.
- Which methodology?: PTES, NIST SP 800-115, OWASP WSTG / MASVS.
- Can we see a sample report?: look for evidence, CVSS, business impact and clear fixes.
- Is re-testing included?: and how long after the test.
- Do you map to our frameworks?: PCI DSS, SOC 2, ISO 27001, HIPAA, GDPR, NIST, CMMC.
- How is our data protected?: NDA, secure evidence storage and deletion policy.
- What are the rules of engagement?: written authorisation, test windows, emergency contacts.
- How are critical issues handled?: immediate notification, not only in the final report.
- Is the price fixed?: fixed-fee quotes based on a documented scope.
FAQ
Frequently Asked Questions
Clear answers about what we do — and what we don’t. If you have any other questions, feel free to reach out to our team.
What does a penetration testing company do?
It performs authorised, simulated attacks on your systems to find exploitable vulnerabilities, then reports them with evidence, severity and remediation guidance, and verifies your fixes.
Should I use a local or international VAPT company?
Methodology, tester quality and reporting matter more than location. Remote delivery works well for application, API and cloud testing; check that the report format is accepted by your auditors and customers.