Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Organizations are investing large sums of money and resources in obtaining ISO 27001 certifications, SOC 2 attestations and performing yearly penetration tests, yet six months after the fact they hear about a breach involving one of their organizations in the media. This trend is so common, that many incident response professionals have used this as a recurring example when conducting post-breach analysis.

Penetration testing has turned into one of those services every business claims to offer, but the actual delivery varies wildly. Some firms hand you an automated scan with a logo slapped on the report. Others put a named, accredited tester on your network who explains exactly what they found and why it matters. For businesses, charities and schools weighing up who to call, the accreditation behind the tester matters as much as the report format. Here are eight providers worth knowing, starting with a CREST-accredited option built around direct access to the people doing the work.