Interestingly most of the comments in this thread are about the quality of existing organisations in this space. My experience echoes this sentiment. Over the

Interestingly most of the comments in this thread are about the quality of existing organisations in this space. My experience echoes this sentiment. Over the years I've worked on systems that have been pen-tested and it's always been the same thing. The testing picks up a bunch of standard/generic and not all that important issues, while missing much worse and glaring specific issues. I've sat in meetings with people from pentesting companies who couldn't describe the attack vector/risk of an exploit they'd said needed patching. I'm sure there are some companies that do it properly but I guess the good ones charge a load more money. Then again, as a lay-enterprise, how do you know who to hire? I know that if I was hired to pentest various systems I've had to work on in the past I'd have picked holes in them all over the place.