A Montréal logistics company asks three firms to quote a penetration test. The numbers come back at $4,500, $12,000 and $28,000. The CFO's first instinct is to take the cheapest. Then she notices the first quote says nothing about scope, methodology or what she'll actually receive at the end.
The three firms aren't proposing the same work. And no ranking will make the choice for you: comparing is your job.
This guide won't tell you which firm to hire. It gives you the criteria, red flags and questions that put quotes on an equal footing, whether or not you end up working with us.
TL;DR
- A serious firm gets a signed authorization and a precise scope before any testing begins.
- Ask to see a sample report: it's the best predictor of what you'll receive.
- Compare fixed-price quotes with identical scope and the retest included or priced upfront.
- Check independence: recommendations that all lead to a product the firm resells are a red flag.
The 12 criteria to check before you sign
A good audit firm meets these 12 criteria and can back each one with a document, a name or an example. Print the list and check it off for every quote.
- Written authorization and rules of engagement. No testing starts until you sign. Without authorization, testing can amount to an offence under the Criminal Code (s. 342.1). Our article on the penetration test authorization letter covers what it should contain.
- Documented methodology. The firm names its frameworks: for example NIST SP 800-115 for technical testing, the OWASP Web Security Testing Guide for web applications, NIST CSF 2.0 for a broader audit. It explains how much of the work is manual.
- Sample report. An anonymized or fictional report shows you the level of detail. Ours is public: see our sample audit report, and ask other firms for theirs.
- Plain-language report. An executive summary leadership can actually read, followed by technical findings for your IT provider. In Quebec, ask whether the report is available in French, English or both.
- Retest. Included, or at least priced in advance, with a window to complete it.
- Fixed price. A firm amount for a written scope, not an "estimated" hourly rate.
- Independence. The firm discloses vendor partnerships and commissions.
- Professional liability insurance. Ask for the certificate and the coverage amount.
- Named team. You know who will do the work, their certifications, and whether any of it is subcontracted.
- Data handling. Encryption, restricted access, short retention and certified deletion at the end of the engagement.
- Immediate notice of critical findings. You don't wait for the final report to learn a server is wide open.
- References. Two or three clients of a similar size who are willing to talk to you.
The data criterion is more than good practice. If the firm will access personal information, section 18.3 of Quebec's Law 25 requires a written mandate that sets out protection measures and bars the firm from keeping that information once the contract ends. (Outside Quebec, federal and provincial privacy laws set similar expectations.) Have the clause reviewed by your legal counsel.
Certifications, explained without jargon
A certification proves that a person passed an exam, not that the firm will do good work for you; it's a useful signal if you know what it measures.
| Certification | Issued by | What it measures | What it doesn't tell you |
|---|---|---|---|
| OSCP / OSCP+ | OffSec | A proctored, 24-hour hands-on exam: attacking real machines and writing up the results. OSCP+ expires after three years. | Whether the tester can explain findings to a small-business owner |
| GPEN | GIAC | A proctored, 82-question, three-hour exam on methodology: planning, reconnaissance, exploitation, password attacks, Azure | Real-world engagement experience |
| CISSP | ISC2 | Five years of required experience; running a security program, aimed at experienced practitioners and managers | It isn't a hands-on penetration testing credential |
Certifications belong to people, not firms. Ask which ones are held by the people assigned to your engagement, not which ones appear on the website.
Red flags
If a firm starts testing before you sign, won't put the scope in writing or can't show you a single sample report, move on to the next one.
Other warning signs deserve a direct question:
- "We already took a quick look at your site": unsolicited scanning, before any authorization.
- A "penetration test" that looks like a raw export from an automated scanner. Our guide on how to read a penetration test report helps you tell the difference.
- A guaranteed outcome: "after our audit, you'll be 100% protected."
- Recommendations that all point to a product the firm resells.
- No clause about your data, or data kept "just in case."
- Sales pressure: a discount that expires Friday, or a "free" audit that turns into a managed services contract.
What you should get: the comparison table
To compare two quotes, line them up against these rows; any blank cell is a question to ask in writing.
| Item | What you should get | Red flag |
|---|---|---|
| Scope | A list of systems, addresses, applications and exclusions | "We'll take a look at your network" |
| Authorization | Signed letter, dates, emergency contacts | No paperwork before testing starts |
| Methodology | Named frameworks, manual work explained | "Our proprietary tool" |
| Report | Executive summary, findings with evidence and prioritized fixes | A raw list of vulnerabilities |
| Language | Report in the language your leadership reads, plus a results meeting | No debrief |
| Retest | Included or priced upfront, with a deadline | Hourly billing with no cap |
| Price | Fixed amount for the written scope | Hourly rate with no maximum |
| Data | Encryption, limited retention, certificate of deletion | No clause at all |
| Team | Names, roles and certifications of the testers | Undisclosed subcontracting |
On budget, Canadian vendor blogs published in 2025 and 2026 put a penetration test anywhere from $5,000 to more than $150,000 depending on scope, and note that retesting is often billed separately. These are indicative market ranges: only a written scope lets you compare prices fairly.
Questions to ask in the first meeting
The best questions have answers you can verify: ask for a document, a name or an example rather than a promise.
- Who exactly will do the work? What are their certifications and their experience with businesses like ours?
- Can you show us a sample report?
- How much of the test is manual, and which tools do you use?
- What happens if you find a critical issue in the middle of testing?
- Is the retest included? Within what timeframe?
- Do you earn commissions on products you might recommend?
- Where will our data be stored during the engagement, and when will it be deleted?
- Can you provide your professional liability insurance certificate?
- Can we speak with two clients of a similar size?
A no-commitment discovery call exists precisely for these questions, before you ask for a quote. We offer a free 30-minute consultation for that purpose; run the same exercise with every firm on your list.
Write a request for quote that firms can compare
The more precise your request, the more comparable the quotes: send the same description to every firm.
At a minimum, include your headcount and number of devices, your main systems (Microsoft 365 or Google Workspace, servers, website, cloud software), what worries you most, your obligations (Law 25, an insurance questionnaire, a client requirement) and your deadline. Also say who on your side will sign the authorization and who will receive the report.
A Gatineau engineering firm that sends this kind of brief to three providers gets back three quotes that finally describe the same thing. It can then choose on report quality, clarity of answers and price, in that order.
To see how we describe our own scope and deliverables, visit our cybersecurity audit page, and compare it with what other firms offer.
Frequently asked questions
How do I choose a cybersecurity company for an audit or penetration test?+
Compare at least two firms on things you can verify: a written scope and authorization before any testing, a methodology based on recognized frameworks, a sample report, a fixed price, a retest that is included or priced upfront, and a clause on deleting your data. Ask who will actually do the work and speak with clients of a similar size. A firm that can't document these points isn't ready to work for you.
What certifications should a penetration tester have?+
The most common are OffSec's OSCP (a 24-hour hands-on exam), GIAC's GPEN (a proctored exam on penetration testing methodology) and ISC2's CISSP, which requires five years of experience and is geared toward running a security program. A certification proves someone passed an exam, not that the deliverable will be good. Ask for a sample report and references as well.
How much does a cybersecurity audit or penetration test cost in Canada?+
According to Canadian vendor blogs published in 2025 and 2026, a penetration test costs from $5,000 to more than $150,000 depending on scope, and a small external test runs about $5,000 to $10,000. These are indicative market ranges. Retesting is often billed separately, so ask for a fixed-price quote that spells it out.
Can a firm that sells security products also audit my business?+
Yes, but it's a potential conflict of interest: the firm may be tempted to recommend products it resells. Ask it to disclose its vendor partnerships and commissions in writing, and require recommendations stated as needs (for example, multi-factor authentication on every account) rather than brand names.
Sources
- 1.Justice Laws Website: Criminal Code, section 342.1 (Unauthorized use of computer)
- 2.NIST SP 800-115: Technical Guide to Information Security Testing and Assessment (2008)
- 3.OWASP: Web Security Testing Guide
- 4.OffSec: PEN-200 and the OSCP certification
- 5.GIAC: GIAC Penetration Tester (GPEN)
- 6.ISC2: CISSP
- 7.LégisQuébec: Act respecting the protection of personal information in the private sector (P-39.1)
- 8.Packetlabs: Guide to the Average Cost of a Pentest in Canada
- 9.Stingrai: Average Cost of a Pentest in Canada (2026)