Editorial standards
These standards describe how The PenTest Index sources, writes, checks and corrects what it publishes.
Responsibility
The PenTest Index is responsible for everything published on this site: the comparison, the Purchase Checks, the buying guidance and every correction. Pages carry the brand byline rather than individual author names. We do not describe reviewers, credentials or recognition that do not exist.
Sources
- Facts about an offer come from the provider’s own primary sources, cited with the page, the section and the date checked.
- Guidance on scoping and reports cites a specific passage of a recognized document, such as NIST SP 800-115 or the OWASP Web Security Testing Guide. A citation supports only that passage and does not mean its publisher endorses this site.
- Where evidence is missing, the site says “not stated” rather than estimating.
Our analysis and supplier statements
A provider’s statements are attributed to the provider and labeled “Provider-published”. Our own calculations, such as a starting amount worked out from a published formula, and our interpretations, such as Purchase Check findings, are labeled as ours. We do not present a provider’s claim as our finding, or our interpretation as the provider’s statement.
Use of AI
AI tools helped prepare this site. They were used to structure the comparison records from our research notes, to draft page copy and to write the site’s code.
An AI tool cannot verify its own interpretation of a source. So each fact is published with the source and section it came from, so the reader can inspect the basis of the statement, and every Purchase Check finding comes from a fixed rule applied to cited observations, with its arithmetic and result reproduced by automated tests. Source attribution and tests do not independently verify the provider’s claim or replace competent review of a technical conclusion.
Review
Purchase Check findings are the most consequential guidance on the site, because they can affect a buying decision.
Arithmetic and rule outputs are reproduced by automated tests. No competent technical review of these findings has been recorded.
A technical-review label is used only after a qualified reviewer has examined the specified material. It must identify the relevant qualifications, scope, date and material conflicts of interest, and state what was not reviewed. Reviewing a price calculation does not constitute reviewing a provider’s testing quality or all the guidance on a page.
Conflicts of interest
- We do not sell penetration testing services.
- This site may contain affiliate or referral links. If you buy through one, we may be compensated. Read how we make money.
- Payment never decides which offers are included, their order, any finding or any correction.
Corrections
We correct any error that changes a fact, price, finding or date, everywhere that fact appears, and record the change with its date in the methodology. A correction needs evidence: the provider’s own page, a written statement from the provider or another primary source.
A provider can correct a fact or dispute a finding with evidence. It cannot approve findings before publication or pay for different treatment. To report an error, follow the correction steps.
Maintenance
Our maintenance schedule calls for monthly checks of provider sources, checks of promotional terms against their stated expiry, and rechecks prompted by reported changes. The methodology explains the schedule. Every offer fact shows its actual check date; a planned review is not a completed review.
Credentials, standards and acceptance claims
A credential belongs to its actual holder: a company, a specific service or an individual. A provider’s assertion is identified as its assertion. Issuer verification requires an applicable issuer record and a check date; one credential is not extended to an entire company or every assigned tester.
A statement about a legal, regulatory, contractual or audit requirement must identify the applicable primary requirement and its scope. General guidance, an older information supplement or a provider’s marketing page is not a substitute. The person relying on the report confirms what evidence they require.
Research releases
A research page states what was measured, the observation unit, how the sample was selected, collection dates, exclusions, missing data, the calculation and the limits of the result. A selected sample of published offers is not a market-wide average. Public prices, private quotes, contracted amounts and documented payments remain separate.
A dataset or sample inspection is described as available only when readers can access the permitted material or the page explains its access limits. Reuse terms and correction notes belong with the actual release. We do not present planned interviews, tests or buyer outcomes as completed research.