You need a penetration test. Maybe an enterprise prospect asked for a report. Maybe your SOC 2 auditor needs evidence of security testing. Maybe you raised a round and your investor’s technical advisor flagged it.
You search “penetration testing company Bangalore” and get a wall of listicles where every company ranks themselves first. That does not help you make a decision.
Here is what actually matters when you are choosing a pentest company, and the questions that will tell you whether they can deliver what you need.
What Separates a Good Pentest from a Bad One
The output of every pentest engagement is a report. The difference between a good pentest and a bad one is what is in that report and how it got there.
A bad pentest runs automated scanners (Nessus, Acunetix, Qualys), packages the output into a branded PDF, and calls it done. The report lists 40 findings, most of which are missing headers and outdated library versions. Your developers spend a week chasing low-severity issues. The business logic flaws in your payment flow, the IDOR in your API, the privilege escalation through your role system. None of that gets tested because no human looked at your application.
A good pentest starts with a human studying your application: understanding your user roles, mapping your API endpoints, reading your business logic. The tester then tries to break things the way a real attacker would: chaining findings, testing authorization on every endpoint, looking for logic flaws specific to your product. The report gives your developers exact reproduction steps, HTTP request/response evidence, and fixes specific to your codebase.
The price might be similar. The value is not.
Six Questions to Ask Before You Sign
1. Who exactly will test my application?
This is the most important question. Ask for names, certifications, and experience.
Certifications that require practical skill:
- OSCP (Offensive Security Certified Professional): The tester had to break into multiple systems in a 24-hour practical exam. This is the industry standard for manual testing ability.
- CREST: Recognized internationally. Requires practical examination.
- CompTIA PenTest+: Tests both knowledge and hands-on skills.
Certifications that test knowledge only:
- CEH (Certified Ethical Hacker): The most common certification. Tests theory, not practical ability. A team with only CEH may miss complex vulnerabilities.
If the company cannot tell you who will do the testing, or says “our team of certified professionals” without naming anyone, that is a red flag. You are buying the skill of a specific person, not a brand name.
2. Can I see a sample report?
A company confident in their work will show you what their output looks like before you pay. Here is ours.
When reviewing a sample report, check for:
- Reproduction steps: Can your developer follow the steps and reproduce the finding? If the report just says “XSS vulnerability found on login page” without showing the exact payload, request, and response, your team will waste time guessing.
- Business impact: Does the report explain what each vulnerability means for your business, or just list CVSS scores? Your CTO needs to prioritize, and a number without context does not help.
- Remediation guidance: Is the fix specific to your stack, or is it a generic “implement input validation” recommendation copied from a template?
If they will not show you a sample report, ask why.
3. What is your methodology?
Every serious pentest follows a structured methodology. The industry standards are OWASP WSTG v5.0 for web applications and PTES (Penetration Testing Execution Standard) for broader engagements.
What you are listening for:
- Do they mention specific testing frameworks, or do they say “we use industry best practices” without naming them?
- Do they test business logic, or just run scanners against OWASP Top 10?
- Do they test authorization on every API endpoint, or just the ones they find through the UI?
- Do they chain findings (combining low-severity issues to demonstrate high-impact attacks)?
A company that cannot clearly explain their testing process probably does not have one.
4. What happens after you find something critical?
During a pentest, the tester might find a critical vulnerability on day 2 of a 7-day engagement. What happens next matters.
Good answers:
- “We notify you immediately by phone or secure channel, with enough detail for your team to start fixing it while testing continues.”
- “Critical findings are reported within hours of discovery, not at the end of the engagement.”
Bad answers:
- “Everything is in the final report.”
- “We will discuss findings in the debrief meeting.”
If your payment data is exposed through an IDOR, you do not want to find out about it two weeks later in a PDF.
5. Is the testing manual or automated?
Both are part of a proper pentest. The question is the ratio.
Automated scanning catches known vulnerabilities: outdated libraries, missing headers, weak TLS configurations. This takes hours and any tool can do it.
Manual testing finds what scanners cannot: broken access controls, business logic flaws, authentication bypasses, chained exploits. This requires a skilled human who understands your application. This is what you are paying for.
If the company’s methodology is mostly automated scanning with some manual verification, you are paying pentest prices for a vulnerability scan. For the difference between the two, read our manual pentest vs automated scanning comparison.
6. What does the engagement timeline look like?
A realistic timeline for a single-scope web application pentest is 5-10 calendar days of active testing. Anything under 3 days for a production application should raise questions about depth.
Ask about:
- Scoping: How do they determine what is in scope and what is out?
- Testing window: Do they test during business hours or off-hours? Will it affect production?
- Reporting: How long after testing ends do you get the report?
- Retest: Is a retest included to verify your fixes? Is there a time limit on the retest?
Red Flags to Watch For
No transparency on team credentials. If they list certifications on their website but will not tell you who holds them, the certifications might belong to someone who is not doing your test.
Only automated tools listed. “We use Burp Suite, Nessus, Acunetix, and OWASP ZAP” describes a toolkit, not a methodology. Tools are part of the process, not the process itself.
Unusually low pricing with fast turnaround. A “complete pentest” for INR 15,000 in 2 days is a scanner run with a branded cover page. Business logic testing alone takes longer than 2 days for any non-trivial application.
No sample report available. A company that has done good work has a report they are proud to show.
Scope defined by the vendor, not collaboratively. If they tell you what to test instead of asking what matters to your business, they are running a standard playbook rather than testing your actual risk areas.
Findings that match scanner output exactly. If every finding in the report is something Nessus or Acunetix would flag, a human probably did not test your application.
What a Good Engagement Looks Like
-
Scoping call: You explain your application, user roles, tech stack, and what triggered the need. The pentest team asks about your business logic, payment flows, multi-tenancy model, and compliance requirements.
-
Clear SOW: You know exactly what is being tested, how long it takes, who is doing the testing, what the deliverables are, and what the retest terms are. No ambiguity.
-
Active testing: The tester is in your application for the full engagement period. They might ask you questions about intended behavior (“should user role X be able to access endpoint Y?”). That is a good sign. It means they are testing authorization, not just scanning.
-
Interim critical alerts: If something critical is found during testing, you hear about it immediately.
-
Detailed report: Findings with reproduction steps, business impact, compliance mapping, and specific remediation guidance. Not a scanner dump.
-
Debrief: A call where the tester walks you through the findings, answers your developers’ questions, and helps you prioritize remediation.
-
Retest: After you fix the findings, the tester verifies the fixes work. Included, not an upsell.
How We Do It at Cyber Secify
We are based in Bengaluru. Both founders are on every engagement. Rathnakara (OSCP, CompTIA PenTest+, M.Sc Cyber Security) leads all testing. Ashok handles scoping, business context, and compliance mapping.
- Startup Pentest (INR 74,999): 1 scope, 7 days, detailed report with remediation guidance, free retest, Brand Protection Snapshot
- Growth Pentest (INR 1,79,999): 2 scopes, 10 days, SOC 2 + ISO 27001 audit prep evidence included
- 6 clients per month maximum. Both founders are hands-on. We do not scale by adding junior testers.
See a sample report | View pricing | Get a free security snapshot