Search for a pen test Manchester provider and dozens of names appear, each promising thorough work and a quick turnaround. Try a pen test Birmingham search and the picture is much the same. Picking between them is harder than it looks, mainly because the product is invisible until the report lands. This guide offers a sensible way to compare suppliers, avoid common disappointments and get real value from the engagement, whichever city the business calls home.
Start with the reason for testing
Before you get in touch with anyone at all you need to have decided why the test is being done. The reasons for the test will vary and that will in turn affect what a good result would be.
Some will be doing it because a customer has requested it as part of a security questionnaire. Others will be responding to a contractual requirement, an insurer's request or an impending audit. A few will simply be wanting to know where they stand. All of those scenarios lead to a very different scope, depth and style of report so it's good instinct on the part of a provider to ask you what the motivation is before they give you a quote.
Compliance-driven testing
Where a framework or client requires a test the paperwork is as important as the actual findings. Which standard applies? Does the tester have to be accredited in a particular way? What does the report have to contain? Getting that wrong means you're going to pay twice.
Curiosity-driven testing
When no-one's externally asking then there's more freedom to look at the systems that would do the most damage if compromised. Customer databases, finance platforms and anything payment related are invariably at the top of that list.
Questions worth asking every supplier
Good providers will of course welcome the scrutiny. Who is actually going to do the work? How long have they been in the profession testing? Which of the recognised bodies do they have accreditation from? In the UK CREST is the name that is invariably bandied about and it's worth checking that the provider's claim is valid.
Ask about the methods too. Manual testing is the only way to find the logic flaws and the chained up weaknesses that the automated tools simply won't pick up on. A supplier who is relying on a scanner is effectively selling a vulnerability scan at a penetration testing price. That's a different product and it's a far cheaper one.
Finally ask to see a sample report with the client details stripped out. The quality of the writing says a lot. Good reports will have clear, specific and prioritised findings. Bad reports will have all sorts of generic warnings and screenshots with no explanation.
What a pen test Manchester companies compare should include
A sensible quote will list the systems in scope, the approach to testing, the expected time frame, what the report will contain and whether retesting is included. If any of those are missing then you need to ask why.
For a penetration test that Manchester organisations are buying the scoping will almost certainly involve a number of different elements at the same time (office networks, cloud tenants, a customer portal and possibly a mobile app). It's useful to split those out on the quote so that the comparison is fair and we don't end up with some of the key areas just getting silently omitted.
Watch how they deal with out of hours work. A lot of the businesses in Greater Manchester (from hospitality groups right through to distribution centres) are 24 hour operations. You can obviously schedule your test to avoid the peak trading times, provided the conversation takes place early enough.
What a pen test Birmingham firms need to settle early
Birmingham teams often have a mixture of old and new tech across their various sites. A penetration test that a Birmingham team commission might carry out could therefore be looking at the head office network, the warehouse, a few of the branches and a supplier link all in the one engagement.
That variety requires clear boundaries. You need to document exactly which sites, IP ranges and applications are yours and which are those of third parties who will need to give their own consent. You could potentially get into a legal mess by testing a system owned by a supplier without their permission so the documentation needs to be clear and unambiguous.
Sector matters as well. The manufacturer is going to care about the operational systems staying online. The law firm is going to care about the confidentiality of the documents. The retailer is going to care about the payment data. The same provider can deliver all three of those things, but the testing plan will be different for each.
Common mistakes that waste a good test
Several errors appear again and again.
Scoping too narrowly is the first issue. Testing just the public website and ignoring the staff VPN is a very large door indeed that you've left open. The other way around is scoping too broadly which results in a very superficial review of everything and a very deep review of nothing.
Another is treating the test as a one-off. The systems change on a weekly basis so a clean result eighteen months ago tells you absolutely nothing about the current state of affairs. A third is failing to get the team properly prepared. If the IT lead is on holiday and no-one else has access to the systems in question then you can easily lose days.
Finally, a lot of businesses will file the report and then do absolutely nothing with it. A finding left open for a year is a gift to anyone who's looking for a way in.
Budget and value
Price will vary depending on the scope, complexity and the experience of the tester. Cheaper is not necessarily worse and dearer is not necessarily better. What matters is that the cost is reflective of proper manual testing from qualified testers and that you get a report which leads to action and support when the questions arise afterwards.
A sensible comparison would look at the number of days, the tester's qualifications and whether retesting is included. Two quotes with the same headline price can be very different in terms of the amount of work involved.
Working relationships
Testing works best when both sides are in the partner mode. Information should be shared openly, questions should be answered promptly and any issues with timing should be raised as soon as they are spotted. Testers in particular should raise any major issues as soon as they are found rather than waiting until they're in the final report. A major issue such as an exposed database should be dealt with by phone not as a footnote.
Bringing it together
A penetration test isn't quite as mysterious once you've got the right questions. Know why you're doing it, insist on accredited people, go through the scope line by line and plan the fixes prior to the report coming in. Whether you're looking for a penetration test in Manchester that a business can trust or a penetration test in Birmingham that the leaders can then go and explain to their board, the supplier who is able to answer your questions honestly and can show you the actual work is generally the one you want.
