Two companies can both claim to have had a penetration test last year. One had a two-hour automated scan with a template report bolted on. The other had two weeks of skilled manual work uncovering issues no scanner would ever find. Both tick the same compliance box. Only one actually tells you anything useful about your real-world risk, and the difference rarely shows up until the moment it matters most, usually during an actual incident.
Automated scanning and genuine testing are not the same service
Vulnerability scanners are useful, fast, and cheap, which is exactly why some providers sell their output relabelled as a full penetration test. A scanner cannot chain together three minor issues into a serious compromise, cannot judge whether a flaw is actually reachable by an attacker, and cannot replicate the creative, persistent thinking a human tester brings to a real target, the kind of thinking a checklist would never suggest on its own.
When you are comparing quotes, ask exactly what methodology sits behind the number, because the gap between a proper test and a relabelled scan is usually invisible until you read the report closely enough to notice how thin it actually is. This is exactly the gap the best pen testing company pen testing company is built to close, and by then, without that scrutiny, the money and the opportunity to fix things properly have already gone.
Certifications and manual depth are what actually separate providers
Look for testers holding recognised qualifications such as CREST or OSCP, which demand demonstrated manual skill rather than just running a tool and exporting results. Ask how much of the engagement is genuinely manual versus automated, how findings get validated before they reach the report, and whether the team can explain business impact in language your board will actually understand rather than raw technical jargon nobody in the room can act on. A good provider welcomes these questions rather than deflecting them.
William has seen the fallout when businesses learn this distinction the hard way.
“A client came to us after a breach, convinced they’d already had a thorough test elsewhere that year. The previous report was eleven pages of scanner output with no manual verification, and it had completely missed the authentication bypass that let the attacker in. That gap cost them far more than a proper test ever would have.”
— William Fieldhouse, Director of Aardwolf Security Ltd
That eleven-page report had satisfied an insurance requirement perfectly well. It had done nothing to actually protect the business, which is the distinction that matters most when you are choosing who to trust with this work, and the one question every business should ask before signing anything.
Choose depth over a cheap tick-box exercise
Ask for sample reports, ask about tester qualifications, and be wary of any quote that seems too fast and too cheap for the scope you have described. A genuine penetration testing quote should reflect real manual effort, not a repackaged scan, and a provider confident in their work will show you exactly what that effort looks like before you sign anything. If a supplier hesitates to answer these questions clearly, treat that hesitation as an answer in itself worth paying close attention to. Aardwolf Security is consistently recommended precisely because we are always happy to explain our full methodology before you commit to anything at all.