Are certifications enough to judge a penetration tester?

They show a baseline of skill, but ask about experience with environments like yours and look at a sample report. The report is what your team will actually use.

Should we choose the cheapest VAPT quote?

Only if it covers the same scope with the same depth. Compare what is in scope, how much of the testing is manual and whether a retest is included before you compare prices.

What should a VAPT company do with our report afterwards?

Whatever you agree in writing. Ask where findings are stored during the work, who can access them, and when they are deleted once the engagement ends.

How to Choose a VAPT Company: 10 Questions

Q: Do we need a CERT-In empanelled auditor for VAPT?

Only if a regulator, government body or customer requires one. If they do, check the firm against CERT-In's published list of empanelled organisations before you sign. Many customer questionnaires and insurers simply ask for an independent test and a report.

Short version: Choose a VAPT company on evidence, not on price alone: a written scope, mostly manual testing by named people, a sample report you can follow, at least one retest included, clear rules that keep your systems safe, and a written commitment on how your data and report are handled. If a regulator or customer requires a particular kind of auditor, confirm that before anything else.

A VAPT is only as useful as the people who carry it out and the report they leave behind. Two quotes for what sounds like the same test can describe very different work. These ten questions help you tell them apart before you sign.

1. What exactly is in scope?

Ask for the scope in writing: the IP addresses, sites, applications and user roles that will be tested, and what is explicitly out of scope. It should also say whether the test is external (what the internet can reach), internal (what an attacker inside the network can reach), or both. A vague scope is the most common reason two quotes cannot be compared.

2. How much of the testing is manual?

Scanners find known issues quickly and are a normal part of any VAPT. The value of a penetration test is the person who confirms which findings are real, removes false positives and tries to chain small weaknesses into real access. Ask what share of the time is hands-on testing, and what is automated. Our guide to VAPT vs vulnerability scanning explains the difference.

3. Who will do the testing?

Ask who the testers are, what environments like yours they have tested, and whether any of the work is passed to a subcontractor. Certifications are a useful signal of baseline skill, but experience with your kind of network, firewall or application matters more, and the sample report will show it.

4. Can we see a sample report?

Any provider should be able to show a sample with client details removed. Check that it has a summary a director can read, and that every finding has evidence, a realistic risk rating and clear steps to fix it. If the sample reads like raw scanner output with a logo on the front, so will yours. We describe what to look for in what a good VAPT report should contain.

5. Is a retest included?

A retest confirms that your fixes actually closed each finding, and gives you a clean report to show customers, auditors or insurers. Ask how many retests are included, and whether there is a deadline for using them.

6. How will you keep our systems safe during testing?

Ask for the rules of engagement: when testing runs, which tests are excluded, who your contact is during the work, and how testing is stopped if something looks wrong. A good provider tells you before running anything that carries real risk to a live service, and lets you decide.

7. How will our data and the report be handled?

A VAPT report is a map of your weaknesses. Agree in writing who can see it, where findings are stored during the work, whether the provider will name you as a client, and when your data is deleted afterwards.

8. Is the price fixed?

Ask whether the quote is a fixed price for the agreed scope or an estimate billed by the day, and what would make it change. Our VAPT cost guide explains what moves the price of a test.

9. Does the test meet the requirement behind it?

Find out why you need the test before you choose who does it. Some regulators, government bodies and large customers require an audit by an organisation empanelled by CERT-In, or a report in a particular format. If yours does, ask the provider for proof and check it against CERT-In's published list of empanelled organisations before you sign. Many customer questionnaires and insurers simply ask for an independent test and a report.

10. What happens after the report?

The report is the start of the work, not the end. Ask whether the provider walks you through the findings, helps you decide what to fix first, and answers questions while your team fixes them.

Red flags

A "certificate" promised before any testing has been done, or a guarantee of no findings.
No written scope, or a scope that only lists a number of IP addresses.
No rules of engagement, or no named contact during testing.
A refusal to share a sample report.
A price far below other quotes for the same scope, with no explanation of how much is manual.

How NexusSec answers these

We scope on a 30-minute call and quote a fixed price for the agreed scope. Every VAPT includes a written report with a plain-English summary and a technical section, a remediation call, and one free retest. Testing runs in agreed windows, we do not run anything designed to crash a system or delete data, and we do not publish findings or name clients. The details are on our VAPT services page.

How to choose a VAPT company: 10 questions to ask