Find My PenTest Match

Settle before you contact providers

• Which application, which environment (production, staging or another) and the hostnames in and out of scope.
• How users sign in and how many user roles should be tested, including administrative roles.
• The business workflows that matter most, such as payments, account changes or data exports.
• What you will provide: documentation, test accounts, source code or none of these. Each is a separate scope decision.
• Restrictions: testing windows, rate limits, third-party services that must not be tested.
• What is excluded, and whether the APIs the application calls are part of this test.

Ask each provider

• “How much of this offer is human testing, how much is automated, and who reviews the findings?”
• “Which of our user roles and workflows does the quoted effort cover?”
• “Are the APIs this application calls included, or priced separately?”

Providers use black-box, gray-box and white-box differently. Ask what access each offer assumes rather than relying on the label.

Settle before you contact providers

• Which APIs and versions are in scope, and where they run.
• The documentation you can share, such as an OpenAPI description or a request collection.
• How clients authenticate, and which permission levels or tenants should be tested.
• The endpoints and workflows that carry the most risk, such as those that move money or expose personal data.
• The environment the provider may test, and any limits on request volume.
• Whether your recipient requires a standalone API assessment or accepts API coverage inside a wider test.

Ask each provider

• “How will you test authorization between users, roles and tenants?”
• “Is API testing included in this offer, or quoted as additional scope?”
• “What documentation and access do you need from us, and when?”

Settle before you contact providers

• Both surfaces: the application and each API, including APIs used only by mobile apps or partners.
• Where the two overlap and what is excluded from each.
• Which user roles must be covered on each surface.
• Whether the effort quoted covers both surfaces or only one.
• The deliverables you need: one combined report or separate reports.
• The complete commitment, including any per-target, per-role or platform charges.

Ask each provider

• “Does this quote cover the application and every API we listed? Please itemize what is included.”
• “How is effort divided between the application and the API?”
• “Which charges change if we add a role, an API or an environment?”

Details to take to an appropriate provider

• What the system is and who owns it.
• Its size: address ranges, accounts, apps, devices or locations.
• Where testing would happen, including any on-site work.
• Restrictions such as operational hours, safety rules or contractual limits.
• Who requested the test and what they need to receive.

Ask each provider

• “What relevant experience do the assigned testers have with this kind of system?”
• “What access and information do you need from us?”
• “What would make the scope, price or schedule change?”

Work out the starting point

• Who asked for the test, or which internal objective it serves, and what they need to receive.
• Which system the request concerns, who owns it, and whether it is a web app, an API or something else.
• Whether the request calls for a penetration test, a vulnerability scan or another assessment. Ask the requester if unsure.
• Whether an existing provider or a service you already pay for could meet the need. Check its actual terms rather than assuming.

Ask the person who requested the test

• “Which systems should the test cover, and is anything excluded?”
• “What must the report show, and by when?”
• “Does the work have to be done by an independent or qualified tester?”