Do you need a local penetration tester?

It is one of the first questions we get asked, usually phrased as whether we can come out and see the office. The honest answer is that for the great majority of penetration testing, being local changes nothing about the work or the result, and a provider who tells you otherwise is selling proximity rather than testing. But there are a few places where it genuinely counts, and they are worth knowing before you pay for travel you do not need.

Why most testing is remote, and why that is not a compromise

A web application test is carried out against the application, over the internet, from wherever the tester happens to be. An external infrastructure test is carried out against your public addresses, which are public from everywhere. In both cases sitting in your car park would give the tester exactly the same view as sitting at a desk fifty miles away, and would cost you a day of travel for the privilege.

This is not a corner being cut. It is how the work is designed. The attacker you are worried about is also remote, so testing from a remote position is testing the thing you actually care about. Where a test genuinely needs a position inside the network, that is usually solved with a small device shipped to you or a virtual machine on your own infrastructure, not with somebody driving over.

Where local does matter

Three situations, in rough order of how often they come up.

An internal test where the network is the point. If the question is what somebody could reach after plugging into a socket in reception, or what a compromised laptop could do laterally, somebody or something has to be inside. A jump box usually solves it, but on segmented industrial or multi-site networks there is often no clean way to place one remotely, and a visit is the quickest route to a useful answer.

A Cyber Essentials Plus audit on a complicated estate. Most Plus audits run perfectly well remotely. Where they do not is where the estate is varied enough that getting onto each sampled device remotely becomes the bottleneck, or where the people who can unlock the machines are spread across a site. Half a day on site can save two days of scheduling.

The first conversation, when the place explains itself. This is the one that is genuinely undervalued. Walking a workshop, a depot or a school and seeing what is actually plugged into what answers scoping questions that a call leaves open. Organisations routinely forget to mention a second unit, a legacy machine or a site retained after an acquisition, and that is reliably where the risk sits.

What being local does not buy you

It does not make the testing better. It does not make the report more relevant. It does not mean the tester understands your sector, which is a function of experience rather than geography. And a local provider who is not CREST accredited and cannot show you who holds which qualification is a worse bet than a competent one two hours away, every time.

If the real reason for wanting somebody local is that you want to meet a human being before you spend several thousand pounds, that is a perfectly good reason and you should say so. It just has nothing to do with the testing.

The questions worth asking instead of asking where they are

1. Who will actually do the test, and what do they hold? Certifications belong to people, not companies. Ask for the individual and check them on the UK Cyber Security Council register where applicable.
2. Is the company CREST accredited, or just the person, or neither? Both layers exist and they are not the same thing.
3. Will the person who scopes it be the person who runs it? In larger firms it frequently is not.
4. What does the report look like? Ask for a redacted sample. A report written for your developers to act on is worth more than a tool output with a logo on it.
5. How is travel charged? If a provider is genuinely local, travel should be nil. If they are not, it should be a visible line rather than something folded into the day rate.

How we handle it

We are based at Albrighton in Shropshire, which puts Telford, Wolverhampton and most of the Black Country inside half an hour and the wider West Midlands inside an hour. There is no travel charge anywhere in that area, so where a visit genuinely helps it costs you nothing to have one.

Further out, in Manchester, North Wales or anywhere else, we work remotely because that suits the work, and if attendance is warranted we travel and quote it as its own line rather than hiding it in a rate. Nobody should be paying for mileage dressed up as expertise.

If you want to know what a test would actually cost for your scope, the cost breakdown sets out the bands, and there are area pages for Shropshire, the West Midlands and Telford.

Common questions