Is there a BBB-type listing or some other reputable badge I should look for when choosing someone to perform a security review?

  • Even if there was a BBB-type listing for security companies it would be useless. The BBB is a useless organization because its really corrupt. I have not seen a single BBB branch that has not skewed its raitings.
    – Ramhound
    Jun 29, 2012 at 11:49

5 Answers 5


No, I don't think there are any well formulated listings or badges.

From my experience a lot of companies will just run some audit software (Like IBM rational AppScan), send you the results and then answer any questions (the results usually define how to fix any issues anyway). Note. I may of just experienced a few average companies.

Personally I would rather save my money and run audit software in-house. Here is a list of reviewed security audit software you may wish to look into if you ever want to run in-house auditing. However, for someone with limited security background this may not be the best option (although you would learn a lot).

Before committing ask around, do some research on each potential auditor and compare them to one another. This should help you weed out any average companies.


  • What would be your specific recommendation for a PHP app that incorporates WordPress, but also has a great deal of custom code (some of it quite old)? Jun 30, 2012 at 1:26
  • It would really depend on a large number factors, like: how large the project is, how paranoid you were at the time about security, were/are you aware of vulnerabilities such as XSS and SQL injection, are you capable of running audit software in-house, and how much time and money you have? Feel free to contact me if you would like to discuss anything in more detail or to bounce questions off (security is extensive).
    – Kurt
    Jun 30, 2012 at 6:24
  • My particular issue turned out to be a CSRF vulnerability in WordPress that was exploited. I can't see any better solution than nuking and rebuilding (this time with a significantly smaller attack surface). I had this philosophy when I was fixing Windoze workstations for a large university and it has stuck with me. Jul 7, 2012 at 2:32

Even reputable companies sometimes give useless or counter-productive feedback; many times it comes down to the experience of the actual representative you talk to. Just search this site for questions dealing with PCI-compliance audits to get an idea of how perfectly backwards some well-established firms can be.

But in the end, what you really need isn't an audit, it's training. An audit is just a snapshot, and it's value disappears almost immediately. But if you can get a firm to act not as an auditor but as a consultant, training you in the proper way to secure your business, then you'll have something of lasting value.

Also, consultants are much easier for you to rate. If you're not learning anything useful from your consultant, then clearly he isn't very good. Try out a few and decide whose style you like, and compare their advice with what you see on this site. It should be pretty straight-forward if you put a little time in to it.


You have some good indicators in some areas:

In the UK, being a CREST approved company means your methodology meets the Council of Registered Ethical Security Testers requirements, and having CREST application or infrastructure testers is a 'gold standard'

Also in the UK, CHECK provides similar assurance, but is more tailored for the public sector.

Other than that, you can go for track record:

In most of the areas I work, the known companies/teams/individuals are the ones in demand and the value behind them is in their name and reputation. This is why a lot of work comes my way - people know me and know the teams I manage (disclaimer, I work for one of the Big-4 accountancy firms, and previously worked with one of the others, so have had large teams in a wide range of clients - which helps for visibility)

For small or low risk security audits you can automate in-house scanning, using one of the known branded tools, but for anything more major you need to be able to tailor the results to your specific business needs. Which is where the big security audit firms come into their own, providing that business or operational risk analysis, rather than just a set of technical results.


I'd say how you would find a good provider depends on your goals for doing it. If you need to prove some kind of compliance or ensure you can pass an audit then I'd say go with a provider who has experience with the criteria you need to pass. If your goal is security improvement rather than compliance then your best bet is to go with recommendations if you can get them, and if not bring in several candidate companies for an interview. Give them one of your web servers to do a scan and tell them to bring the sample results.

Some will bring you canned results which are just output from some automated tool where they obviously haven't given it a second glance. Their results may have have obvious false positives like saying that there are linux vulnerabilities which aren't applicable to your system, or vulnerabilities for software that isn't present on the system. There may be some filler around ICMP to bulk it out. Good ones will have used the results as a jumping off point to dig for further results. They will have filtered out the false positives and useless entries and done further exploration into your systems.

I don't recommend you do it yourself unless you have a great deal of background in it.


You can consider company to be AAA+++ if they do publish their processes on their website :P E.g. they tell that they do training first, then design, integration, validation and how they handle the release, like certification etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.