How can you find the best penetration testing services to assess your organization's security?

For a number of reasons, I believe that finding vulnerabilities through human testing is the most effective and has the fewest errors. Firstly, there are no optimal tools for vulnerability scanning that cover all cyber dangers; instead, each tool is specific to finding a certain field of security vulnerabilities. Furthermore, while using tools for scanning, there are false positives and false negatives that need to be verified by humans after the tool scanning is finished. In conclusion, I believe that human testing should be used in penetration testing to find security holes and human approval should also be obtained for the results of tool scanning.

As you're evaluating your needs, make sure to prioritize organization's most valuable and vulnerable assets first. Take a close look at your own organization's security needs. What kinds of sensitive data and critical systems do you have that must be protected? Having a clear picture of your highest risk areas will help you find a good pentesting plan.

After identifying the organization’s needs, the next step is to research firms. Look for reputable penetration testing firms with a track record of successful engagements and positive client reviews. Online research, industry recommendations, and peer referrals can help identify top contenders.

In the mobile apps field you should look after firms offering OWASP MAS compliant testing as a baseline. MAST tooling in your CI can prevent some issues.

It is important to inquire about the penetration testing methodology the firm employs. This ensures it aligns with industry standards such as the Penetration Testing Execution Standard (PTES) or the Open Web Application Security Project (OWASP) Testing Guide.

The organization has to assess the expertise and experience of the penetration testing team. Look for certifications such as Certified Ethical Hacker (CEH), Offensive Security Certified Professional (OSCP), or Certified Information Systems Security Professional (CISSP). Experience in your industry vertical can also be advantageous.

Communication is key and it’s very important to assess the firm's communication practices and willingness to collaborate with your internal security team. Effective communication throughout the engagement is crucial for understanding findings and addressing any concerns.

Proper threat modelling & articulation of your needs is a must. Don't expect good results if you won't communicate your pain points well - pentesters can do only so much.

Price-sensitive approach: "shotgun-surgery" using SAST tools in your pipelines, pentest manually only specific use-cases. If you insist on testing everything on a low budget, results will be mediocre. Mediocre results are useless.