Vulnerability Assessment and Penetration Testing Procurement Guide

Vulnerability assessment and penetration testing are related services, but they answer different questions. An assessment identifies and prioritises known weaknesses across a defined scope. A penetration test uses agreed techniques to test whether weaknesses can be exploited and what access or business impact may follow. A sound procurement defines which question must be answered before comparing providers.

CYBORIUM helps Australian organisations evaluate security testing providers through a structured, vendor-neutral sourcing process. The selected provider pays CYBORIUM a capped fee. The client contracts directly with that provider, and CYBORIUM does not sell, deliver, operate or invoice the testing service.

Define the testing objective

Start with the decision the test must support. The organisation may need release assurance for an application, evidence for a control framework, validation of remediation, testing of an external attack surface or a broader view of how an attacker could move through the environment.

Each objective changes the scope, method and evidence. A broad request for a “penetration test” often produces proposals that cannot be compared because providers make different assumptions about access, time, techniques and reporting.

Build a scope that providers can price

The request should identify the applications, APIs, network ranges, cloud services, identities, locations and environments in scope. It should also state testing windows, production restrictions, prohibited techniques, available accounts and known dependencies.

Ask providers to list every assumption and exclusion. The lowest price may reflect less testing rather than better value. A comparable response separates fixed scope, optional scope and rates for retesting or additional findings.

Evidence to request

• Method: the testing stages, tools, manual techniques and quality review process.
• People: the named team, relevant experience and who will review the final report.
• Safety: rules of engagement, stop conditions, escalation paths and handling of sensitive data.
• Coverage: a clear mapping between the requested assets and the proposed testing effort.
• Findings: sample technical evidence, business impact, reproduction detail and prioritisation method.
• Remediation: clarification support, retesting terms and evidence that a finding has been closed.
• Assurance: insurance, subcontractor use, data location, retention and secure disposal.
• Commercials: fixed fees, assumptions, travel, after-hours work, retesting and change control.

How to evaluate shortlisted providers

Test methodology, not tool lists

Automated scanners are useful, but a penetration test should explain where human judgement is applied. Ask the provider to walk through how it would test a representative attack path and how it avoids treating scanner output as a confirmed finding.

Use a sample finding

Give each shortlisted provider the same fictional finding and ask for an executive summary, technical evidence and remediation guidance. This shows whether the report will be useful to the board, security team and system owner.

Check operating discipline

Testing can affect live services. Confirm who can approve a risky technique, how the provider communicates during the engagement and what happens if it finds evidence of an active compromise. These details belong in the rules of engagement and contract, not in an informal email after work starts.

Compare total cost

Include planning, testing, reporting, workshops, retesting and remediation support. If the test is recurring, compare the method for tracking changes between cycles. A cheap initial engagement can create more cost if every clarification or retest becomes a separate charge.

Procurement deliverables

A well-structured engagement should produce an approved scope, rules of engagement, test plan, contact matrix, findings report, executive summary, remediation register and retest evidence. The contract should identify acceptance criteria and the process for resolving disputed findings.

For recurring testing, define which changes trigger an additional test and how results will be compared over time. This turns an isolated exercise into a repeatable assurance process.

CYBORIUM’s role in the decision

CYBORIUM can define the requirements, standardise provider responses, assess proposed methods, compare commercial structures and support negotiation. The organisation retains control of the decision and contracts directly with the selected testing provider.

The goal is a test that answers a defined business and security question, with evidence the organisation can use. It is not a generic report built around the provider’s preferred toolset.

Primary reference

• Australian Government Information Security Manual, June 2026 changes

Reviewed by Michael Kazantzis for CYBORIUM on 22 July 2026. This guide explains CYBORIUM’s procurement evaluation method. It does not provide legal or regulatory advice.