I'm a beginner-level penetration tester, I've noticed that after the pentesting, you just report the vulnerabilities you've found and the possible exploit points that you've discovered. Using the common vulnerabilities posted in vulnerabilities DB is so useful, but is there any "CRITERIA" to distinguish between good and bad pentester?

closed as primarily opinion-based by Stephane, Ohnana, WhiteWinterWolf, Matthew, Deer Hunter Jan 20 '16 at 20:59

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Criteria in terms of reporting vulnerabilities? I'm not sure how your question relates to your setup of the question. – schroeder Jan 21 '16 at 4:41

Good pen testers tend to have three qualities: an attention to detail whilst following a flexible process so that nothing is missed, patience to keep going at something when they have a gut feeling that there's 'something there', and a lot of experience (which is how they get the 'gut' feeling in the first place).

Poor pen testers follow a rigid checklist process (regardless of findings during the test) and use basic tools and simply report the tool output back to the client. Good pen testers can review findings and understand and discuss the real-world risk associated with vulnerabilities.

Poor pen testers don't understand all of the implications of the vulnerabilities their tools discover. Good pen testers have seen, or can foresee, how one vulnerability can be exploited further, or how multiple vulnerabilities can be combined to create a bigger risk. Good pen testers can also recommend compensating technical controls other than the most immediate recommendations.

Poor pen testers are often opaque in their process. Good pen testers are happy to show their working, their logs, and also (perhaps more importantly) discuss what they haven't tested, and why.

Poor pen testers sometimes believe, and even tell their clients, that a clean test result means the systems they are testing are 'secure'! Good pen testers also understand the role of pen testing as part of an overall security governance programme and that their own work may not have 100% coverage, and are only a snapshot of security status at the time of testing.


A pentester would never operate alone, there are too many errors and omissions. If you are looking for accreditation, look for it at the team, or member-company, level.

In the UK (I am from the US, but I realize that the standards of quality in the UK are obviously slightly higher than ours), the two primary standards (and they go together) are the CBEST PENETRATION TESTING Services and the Tigerscheme CHECK Team Leader / Team Member qualifications.

Not the answer you're looking for? Browse other questions tagged or ask your own question.