How to choose a pentest vendor and not buy a scan in a cover

Choosing a pentest vendor comes down to three questions you can ask before the contract. Where the boundaries are. How a finding is confirmed. What you will be able to do with the file in a week. If the first answer is "we will look at everything", the second is "we have a scanner", and the third is "we will send a PDF", the conversation can end.

What to ask directly

• Whether written permission and an address list come before the first check.
• Whether the raw scanner output enters the report or only what was confirmed.
• Whether a retest is included and who fixes things: them, your developer or nobody.
• Whether they promise a certificate or a license they do not have. We, for example, do not issue compliance certificates.

A price without a scope means nothing. A guide of "from $50 per endpoint" is honest only together with the question of how many apps and roles you have. A landing often does not need a pentest at all: for new clients we first offer the free basic audit. For a store and an account area we name 1-3 weeks and do not hide a production load test inside that.

Lexora is ready for these questions pointed at us. If after a short call it turns out you need monitoring, backups or an access review rather than a pentest, we will say so. Selling the wrong job costs more than declining.