I think that's what bug bounty companies are doing by changing the model from paying for time spent to paying for (accepted) findings. Personally I don't think

I think that's what bug bounty companies are doing by changing the model from paying for time spent to paying for (accepted) findings. Personally I don't think any serious pentester will spend considerable time in this model though. That said, I also think that one of the main challenges for buyers of pentest services these days is to evaluate the quality of a report or of the work done. Thoughts on how to improve that are most welcome.