Compare cybersecurity audit quotes in London

Why ask it: Firm-level CREST accreditation does not guarantee the individual who runs your test is certified. A firm can be CREST-accredited while deploying junior or uncertified testers on day-to-day engagements. Asking for individual certification for the named tester is the only way to verify who is actually doing the work.

Good answer: They name the specific tester, confirm their CREST certification level (CRT, CCT, or equivalent), and offer to provide documentation. They can also explain why that individual is suited to your specific scope - web application testing and infrastructure testing require different specialisations.

Red flag: "Our team is CREST-accredited" without identifying the individual. That is firm-level accreditation, not individual, and tells you nothing about who will actually test your systems.

Why ask it: Cloud assets and remote endpoints are where most modern attacks succeed, and they are also the most commonly excluded items in a standard pentest scope. Asking this directly before signing forces the firm to be explicit about what they will and will not test, and surfaces scope gaps before they become invoice disputes.

Good answer: A specific answer that names which cloud platforms are in scope (Microsoft 365, Azure, AWS, etc.), how remote endpoints are tested (agent-based, VPN access, or excluded), and an explanation of any out-of-scope items with a reason. A firm that has thought carefully about scope can answer this without hesitation.

Red flag: A vague answer like "we cover your infrastructure" without specifying cloud or remote assets. That usually means those assets are out of scope and the firm is hoping you do not notice until after signing.

Why ask it: Report quality is the deliverable - not the test itself. A technically competent test that produces an unusable report has limited value, particularly if you need to present findings to a client, board, or regulator. Reviewing a sample report before you commit is the most direct way to assess whether the firm communicates findings clearly.

Good answer: They provide a sample promptly, ideally one relevant to your sector or scope type. The sample shows clear severity ratings with justification, proof-of-concept evidence for findings, and an executive summary that a non-technical reader could act on.

Red flag: "We can't share client reports due to confidentiality." A properly redacted sample removes all identifying information - confidentiality is not a valid reason to refuse. Refusal usually means the firm is uncomfortable with the quality of their reports.

Why ask it: This question surfaces the firm's commercial model. Firms that price remediation only after seeing the findings are in a structurally advantaged negotiating position - they know exactly what needs fixing and you are under pressure to act. Understanding this upfront lets you either get remediation included, get a pre-agreed rate, or plan to use a different firm for remediation.

Good answer: They confirm whether a remediation review is included (typically one or two consulting sessions to review your proposed fixes), or they quote a fixed rate for remediation support independent of the findings. Either is acceptable - what matters is that it is pre-agreed.

Red flag: "We'll scope remediation once we've seen the findings." That means the firm will price remediation at the moment of maximum leverage. Treat it as a blank cheque.

Why ask it: Without a pre-agreed retest policy, you are paying full day rates to verify that your own fixes worked. For FCA-regulated or client-facing audits where a completed retest is required to close the assurance cycle, this is not optional. Establishing the terms before signing removes the leverage asymmetry that occurs once you have seen the findings.

Good answer: A specific retest policy: for example, one retest of critical and high findings within 90 days of the initial report, included in the price. Or a fixed retest day rate agreed upfront. The key is that it is pre-agreed rather than decided after you have seen what needs retesting.

Red flag: "We'll discuss retest pricing after the report is delivered." That is the moment when you have the least negotiating leverage and the firm has the most. Any firm unwilling to pre-agree retest terms is telling you something about how they approach commercial relationships.

Why ask it: Severity ratings drive remediation prioritisation and boardroom communication. Firms that inflate severity across the board either do not have a calibrated methodology or are using alarming ratings to drive remediation engagements. Understanding how they calibrate severity before the test tells you whether you can trust the ratings in the report.

Good answer: A clear explanation referencing industry-standard frameworks (CVSS scoring, OWASP risk rating, or NCSC guidance) with specific examples of what would and would not qualify as "Critical." The firm should be comfortable explaining that not all engagements produce critical findings, and that a clean result is a valid outcome.

Red flag: A vague answer like "we rate based on potential impact" without reference to a methodology. Or any suggestion that the firm consistently finds critical vulnerabilities in every engagement - that implies miscalibration rather than consistency.