I just wrote an article on this as it always seems to be a common question for clients. I have summed up 3 considerations for both perspectives:
REASONS FOR ALTERNATING VENDORS:
1. Complacency
Application security engineers just like developers can be blind to some aspects of their work. For software developers, it can be very hard to find their own bugs, hence the practice of peer code review and the slew of quality assurance controls that are put in place such as unit tests, manual and automated quality assurance tests.
One of the questions you need to ask your pentest vendor is what do they do to overcome this problem.
2. Quality and value Intelligence
It might be worth to consider other vendors to understand what service you are getting at what price point. Additionally, not all penetration testing providers are created equal, so one vendor could be really good at identifying vulnerabilities but post-report support might not be great, while another vendor really excels at the services provided post-report.
3. Leveraging different expertise
It might be worth exploring different vendors for different expertise areas. For example, one vendor could be very strong in performing a pentest, but not as much in social engineering. So leveraging different vendors for different areas of strengths can be beneficial.
CONSIDER BEFORE SWITCHING:
1 . Losing Context and application knowledge: there is most likely 3 levels of depth to any pentest:
Level 1: The low hanging fruit: which is basically what any scanner can find.
Level 2: The medium range issues: bugs that scanners can’t find but an engineer can, they are still easy to find, it just needs someone looking for them, agile enough with their approach.
Level 3: The Difficult Bug: these are only found when the engineer gets intimate enough with the application to understand exactly how it works.
For a 2–3 week long penetration test, it is very hard for a new vendor to reach Level 3 in such a short amount of time. Depending on the nature of your application, there might not be a lot of business logic to the application and hence there is no need for Level 3. Another thing to consider is who are your primary threat actors? Are you up mostly against script kiddies or professional hackers and cyber gangs?
2 . Losing the Partner relationship: it takes time for a pentest service to understand your business, application, and the dynamics of your team. Working with a pentest provider should not stop at the delivery of the report. A good pentest provider should be able to identify really good bugs, and more importantly help you mitigate those bugs and further fortify the application. If you are not getting that help from your current vendor, it might be worth it to have a conversation with that vendor or search for a new one.
3 . Losing Motivation: for most companies in the professional services space, it is (or at least it should be) their top priority to go the extra mile to keep their clients. Knowing from the get go that it is a temporary relationship might not motivate that vendor to go above and beyond for you.
There are several factors that go into choosing a pentest partner: skills, history, price, and processes among others. Building a solid relationship with them and getting the most value requires communication, trust and transparency.