Buyer guide

How to choose a trustworthy security firm

The security market is full of genuine experts and outright scams. This guide gives you the questions to ask, the credentials to verify, and the red flags that separate a lawful firm from a criminal "hacker-for-hire."

Verify credentialsDemand authorizationSpot scams

Questions to ask before you sign

Credentials & insurance

  • Which certifications do your testers hold?
  • Can you provide proof of insurance?
  • Who will actually perform the work?

Method & scope

  • What methodology do you follow (OWASP, PTES)?
  • What is in scope, and what is excluded?
  • Do you include retesting after fixes?

Legal & ethics

  • Do you require written authorization?
  • How do you handle the data you find?
  • Will you sign an NDA and a clear contract?

Deliverables

  • Can we see a sample (redacted) report?
  • Do you provide an executive summary?
  • Are remediation steps actionable?

Recognized credentials include OSCP CISSP CEH GPEN CREST — but always verify them independently rather than trusting a website listing.

Red flags of a scam

Walk away immediately if you see any of these. They mark an illegal operation, not a professional firm.

  • Offers to hack an account, phone or profile belonging to someone else
  • Claims no authorization or contract is needed
  • Guarantees results, like "recovered funds" or "any password"
  • Demands payment only in crypto or gift cards, with no invoice
  • Asks for an upfront "deposit" before any scoping conversation
  • No verifiable identity, address, company registration or references

Why this matters. Paying a "hacker-for-hire" to access a third party is a crime, and most such offers simply take your money and disappear — or blackmail you afterward. Lawful firms never ask you to break the law.

Frequently asked questions

What certifications should a security firm have?
Look for recognized credentials such as OSCP, CISSP, CEH, GPEN or CREST membership, plus professional indemnity and cyber liability insurance. Certifications should be verifiable, not just listed on a website.
What is the biggest red flag when hiring a hacker?
Any offer to access an account, device or system belonging to someone else. Legitimate firms only work on assets you own or control and require written authorization. Hacker-for-hire services are illegal scams.

Related: Acceptable use & authorization · About our approach

Want a firm that works strictly within the law?

We only test systems you own or control, with written authorization, clear scope and verifiable reporting. Start a conversation below.

Request a scope All services