Penetration testing isn't a one-size-fits-all engagement—what your organization actually needs depends on your risk profile, compliance requirements, and infrastructure complexity. When you're vetting penetration testers, the questions they ask you matter just as much as the ones you ask them. Understanding what testers are really digging at helps you evaluate whether they understand your business and can deliver actionable results.
"What's Your Current Security Posture?"
This is the tester's way of asking: are you starting from zero or do you already have controls in place? They're not making small talk. A good penetration tester needs to know whether you've had previous assessments, what vulnerabilities were found, and whether you've remediated them. They're also gauging how mature your security practices are overall—do you have an incident response plan? Asset inventory? Security awareness training?
Your answer determines scope and methodology. If you're pre-security-program, testers typically recommend a broader assessment ($8,000–$15,000 for SMBs). If you're mature and looking for targeted testing, they'll scope down accordingly.
"What Systems or Applications Are Out of Bounds?"
Testers ask this to establish legal and practical boundaries before testing begins. This is critical—it protects both parties. They need to know:
- Which production systems can't be stress-tested without impacting business continuity
- Which legacy systems run on fragile infrastructure
- Whether you have any air-gapped or isolated networks
- If there are any third-party systems they shouldn't touch
This question also reveals whether you've thought through the scope. If you can't answer it clearly, you may need a scoping call with the testing team (usually 30–60 minutes, included in most quotes) to map what's actually testable.
"Are You Testing for Compliance or Risk Reduction?"
This determines the entire testing philosophy. Compliance-driven tests (PCI-DSS, HIPAA, SOC 2) follow strict methodologies and produce heavily documented evidence for auditors. Risk-focused assessments are more flexible—testers prioritize finding what actually exploitable on your infrastructure, rather than checking boxes.
If you need compliance proof, expect a formal report with detailed evidence and remediation guidance ($10,000–$25,000 depending on complexity). If it's risk-focused, you'll get tactical recommendations and sometimes raw exploitation demonstrations, often at a lower cost.
"What's Your Timeline for Remediation?"
Testers use this to understand how aggressively they should test. Some clients can't afford application downtime, so testers will use passive reconnaissance and non-destructive methods. Others can take a system offline for thorough testing.
They're also assessing whether you're serious. An organization asking "we need a pentest" without a remediation plan is often wasting money—vulnerabilities don't fix themselves. Realistic timelines matter: critical findings should be addressed in 30 days, high-risk in 60–90 days, and medium-priority within six months.
"Do You Want Testing of Your Staff (Social Engineering/Phishing)?"
Human vulnerability testing isn't always included in standard packages. This question tells you whether the tester thinks your biggest risk is technical or human-centered. Many breaches start with a phishing email or an impersonation call, not a zero-day exploit.
Social engineering add-ons typically cost $2,000–$5,000 extra but can be eye-opening. If your organization has had any security incidents involving credential compromise, this is worth including.
"Who Owns Security on Your Side?"
This reveals whether there's actually someone responsible for remediation once the assessment ends. A tester needs a point of contact who can authorize testing windows, answer technical questions, and drive fixes. If you don't have a designated security lead or CISO, you might need to assign one internally before testing starts—otherwise recommendations sit in a drawer.
What This All Means for Your Purchase
These questions aren't obstacles—they're signs a tester is professional and thorough. If a penetration testing firm quotes you without asking any of these questions, that's a red flag. They don't understand your context, and their report will likely be generic and low-value.
When comparing penetration testing providers, Mercoly helps you find vetted firms in your area, compare their methodologies, and understand whether they're asking the right discovery questions before diving into testing.
Frequently Asked Questions
Q: How much does a penetration test actually cost? A: Typical range is $3,000–$20,000+ depending on scope, with smaller engagements (single application or network segment) at the lower end and enterprise-wide testing at the higher end. ASM and threat modeling assessments run $2,000–$5,000.
Q: How long does a pentest take? A: Most external network penetration tests take 1–2 weeks of active testing, with reporting taking another 1–2 weeks; internal assessments or application testing may take 2–4 weeks depending on complexity.
Q: Do I need to let employees know about social engineering testing? A: Best practice is to notify leadership but not the general staff, otherwise results are meaningless—you want to test real-world response, not a prepared defense.
Find the right penetration testing partner for your organization's needs on Mercoly.