CREST accreditation gives buyers an established way to identify penetration testing companies that have been assessed against defined technical, operational, and ethical standards. But accreditation is only useful when buyers can confirm that the company, service scope, and accreditation status match the requirements of the engagement. This makes knowing how to verify a CREST accredited company an important part of security vendor due diligence.
Suppliers need to improve their security. According to the UK Government Cyber Security Breaches Survey of 2025-2026, only 15% of firms formally assessed the cybersecurity threats posed by their immediate suppliers. Large organizations increased that number to 48%.
In this blog, we will discuss how to choose an organisation using the CREST Marketplace, an accredited service. We will also discuss verification of tester credentials, supporting documentation, and common procurement pitfalls.
Key Takeaways
- CREST accreditation focuses on the organization itself, and CREST certification refers to the testers.
- Accreditation is service-specific, so ensure that the provider is accredited for the appropriate service.
- Use the official CREST Marketplace to confirm the accreditation status of the provider.
- Evaluate the provider’s profile regarding service capabilities, industry, and expertise.
- Seek additional supporting documentation, such as tester qualifications, report samples, and Rules of Engagement.
- Do not confuse the membership of CREST with accreditation, nor does the accreditation mean that all services are covered.
- Conduct a complete review of the engagement to make sure the requirements are met.
What Is CREST Accreditation For a Penetration Testing Company?
CREST accreditation proves that a security service provider has been assessed independently based on their professional security services. When learning how to verify a CREST accredited company, it is important to understand what the accreditation actually covers and what it does not guarantee.
Company Accreditation vs Individual Certification
CREST accreditation applies to the organization, while CREST certifications apply to individual cybersecurity professionals. A company’s accreditation can assess areas such as:
- Governance and quality management – processes for managing security testing engagements and maintaining service quality.
- Information security and data handling – controls for protecting client information, test data, and sensitive findings.
- Technical methodology – defined approaches for planning and conducting security assessments.
- Risk and engagement management – controls for scoping, managing testing risks, escalation, and client communication.
- Operational controls – areas such as insurance, personnel screening, contract management, data retention, and quality assurance.
Accreditation Is Service-Specific
The CREST accreditation may be specific to some security services that the organization provides as opposed to all services provided by the organization. These services could be penetration testing, intelligence-led penetration testing, threat intelligence, incident response, vulnerability assessment, and security operations.
Buyers must make sure that the accredited service is in line with the needed tests, such as the following:
- Internal or external Infrastructure testing
- Web application and API testing
- Cloud security testing
- Mobile application testing
- Red team or intelligence-led testing
What CREST Accreditation Does Not Guarantee
CREST accreditation ensures that the service provider has fulfilled the assessed requirements to provide security services professionally and safely. This is not an indication that:
- Testing can never cause service disruption.
- Every tester assigned to an engagement holds an individual CREST certification.
- The engagement automatically satisfies PCI DSS, HIPAA, GDPR, or ISO 27001 requirements.
CREST accreditation can support compliance objectives when the testing scope, methodology, evidence, reporting, and retesting align with the requirements of the applicable framework.
How To Verify a CREST-Accredited Company?
Before choosing a penetration testing company, check the credentials of the company on the CREST Marketplace and not just the badge on the website. There, you will find all the penetration testing companies that have been evaluated against the technical, operational, and ethical requirements of CREST.
Use these checks when reviewing a provider:
- Search the official Marketplace: Look up the supplier using its legal or registered company name, rather than relying only on its trading name.
- Confirm the relevant service: Check that the company is accredited for the specific service required, such as infrastructure, web application, mobile, cloud, or intelligence-led penetration testing.
- Check the legal entity: Make sure the company listed by CREST is the same entity named in the proposal, contract, and invoice.
- Confirm who will deliver the testing: Ask whether the accredited entity will perform the assessment directly or whether delivery involves a subsidiary, affiliate, contractor, or overseas office.
- Review accreditation details: Record the provider’s listed accreditations, service areas, specialisms, and current Marketplace status. Where renewal, expiry, or scope details are unclear, request confirmation from the provider or CREST.
- Validate the proposed team: Review the experience and relevant individual CREST certifications of the testers assigned to the engagement. Company accreditation does not mean every consultant holds an individual CREST certification.
- Compare the quotation with the accreditation: Check that the proposed testing scope, methodology, reporting approach, and delivery team correspond with the service for which the company holds accreditation.
What Should You Check on a Company’s CREST Marketplace Profile?
After identifying a provider on CREST Marketplace, check out the provider’s profile for useful details about its strengths and compatibility with your needs. Currently, the CREST Marketplace contains profiles of 549 providers. Offering information such as the size of the technical team, delivery model, project size, target sectors, and technology focus.
- Capabilities of the provider: Examine the offered security services and capabilities to see if they meet the needs of the assessment.
- Technical specialisms: See if the provider has expertise in the area being assessed, such as web applications, cloud, mobile, infrastructure, or threat-led testing.
- Size of the team and service delivery method: Analyze the available information about technical staff and the type of service delivery used.
- Focus on industry and technology: Examine the industries and technologies listed in the profile to verify that they are related to the company under consideration.
- Consistency with the proposal: Compare the Marketplace profile with the provider’s proposal and scope of work. Clarify any major differences before proceeding.
The Marketplace profile provides useful information for comparing providers, but it should be supported by further due diligence before the engagement is finalised.
What Evidence Should You Check Before Choosing a CREST-Accredited Vendor?
A CREST Marketplace profile is a useful starting point. But you should also request supporting evidence from the provider before signing the Statement of Work (SOW). These documents help confirm the information provided during vendor evaluation and show how the assessment will be managed.
- Current CREST accreditation evidence: Request documentation showing the provider’s current accreditation and confirm that the legal entity and relevant service match the proposed engagement.
- Assigned tester credentials: Ask for the relevant qualifications of the consultants who will conduct the assessment, such as CREST Registered Penetration Tester (CRT) or CREST Certified Tester (CCT), where applicable.
- Redacted sample report: Review a sample report to assess how findings are explained, risks are rated, and remediation recommendations are presented.
- Rules of Engagement and scope: Check that the documents clearly define the targets, testing methods, permitted activities, testing window, communication process, and emergency stop procedures.
- Data handling and retention: Ask how test data, credentials, configuration files, and vulnerability evidence will be stored, protected, retained, and securely deleted after the engagement.
These documents give procurement and security teams evidence beyond the Marketplace listing and help confirm that the proposed engagement is properly scoped, controlled, and documented.
What Common Mistakes Do Organisations Often Make While Choosing a CREST-Accredited Penetration Testing Company?
Many organizations encounter severe compliance and security pitfalls during the procurement lifecycle due to superficial vetting practices or a misunderstanding of how accreditation applies. Recognizing these common errors helps risk management teams protect their investments and maintain audit readiness.
Frequent pitfalls to avoid include:
- Assuming Corporate Membership Equals Technical Accreditation: Treating general CREST membership as proof of penetration testing capability, failing to realize that membership and service accreditation are distinct statuses.
- Failing to Verify Individual Assessor Credentials: Checking that the company is accredited while completely neglecting to verify whether the actual consultants executing the technical testing hold individual CREST certifications.
- Neglecting Scope Alignment: Hiring a vendor accredited only for basic infrastructure testing to perform complex cloud-native microservices or advanced mobile application assessments.
- Overlooking Subcontractor Risks: Failing to contractually prohibit the vendor from subcontracting testing tasks to unverified, unaccredited third-party freelancers.
- Accepting Static Self-Attestations: Relying on PDF certificates or email attachments provided by the vendor without independently validating the status against the live CREST Marketplace registry.
How Qualysec Supports Your CREST-Accredited Penetration Testing Needs
Choosing a CREST-accredited penetration testing company is only the first step. You also need to know how thoroughly your systems will be tested, how clearly the findings will be explained, and what support you will receive to fix the issues.
At Qualysec, we combine manual testing with recognised security testing methodologies, including OWASP, NIST SP 800-115, PTES, and OSSTMM. Our penetration testing services cover web applications, mobile applications, APIs, networks, and cloud environments.
Here is how our approach helps you get more value from your assessment:
- Find weaknesses beyond automated scans: We manually validate findings to identify exploitable vulnerabilities, including access control issues and business logic flaws that automated tools may miss.
- Define your testing scope clearly: We establish the systems to be tested, permitted testing activities, and communication procedures before the assessment begins.
- Understand your security risks: Our reports explain each finding, its severity, potential impact, supporting evidence, and recommended fixes so your team can prioritise remediation.
- Get support after testing: We help your team understand reported vulnerabilities and provide retesting to check whether the identified issues have been resolved.
This approach helps you understand where your security controls need improvement and what actions your team should take next. Instead of receiving a list of vulnerabilities alone, you get findings that your team can use to plan and verify remediation.
Before starting an engagement, you should also confirm that the proposed testing service falls within our current CREST accreditation scope and review the qualifications of the testers assigned to your project. This helps ensure that the assessment aligns with your security requirements and expectations.
Conclusion
Choosing the right penetration testing provider requires more than finding a CREST logo on a website. Knowing how to verify a CREST accredited company helps buyers confirm that the provider, accreditation scope, testing team, and proposed engagement all align with their requirements. Start with the official CREST Marketplace and review the provider’s profile. Request relevant evidence and clarify any gaps before signing the SOW. This helps security and procurement teams choose a trusted provider and ensures the assessment meets internal and regulatory requirements.
FAQs
1. How can you verify if a penetration testing company is CREST-accredited?
Search for the company on the official CREST Marketplace using its registered name. Check its current accreditation status, approved services, and whether the listed legal entity matches your proposed contract.
2. What is the difference between CREST accreditation and CREST certification?
CREST accreditation applies to companies, while CREST certification applies to individual cybersecurity professionals. Check both the provider’s approved services and the qualifications of the testers assigned to your assessment.
3. Does CREST accreditation cover all penetration testing services offered by a company?
No. CREST accreditation is service-specific. Verify that the provider is accredited for your required assessment, such as web application, cloud, mobile, or infrastructure penetration testing.
4. What documents should you request before hiring a CREST-accredited penetration testing company?
Request current accreditation evidence, tester qualifications, a sample report, and the scope of work. Review the Rules of Engagement and confirm how your data will be protected and retained.
5. Does hiring a CREST-accredited penetration testing company guarantee compliance with ISO 27001, GDPR, or PCI DSS?
No. CREST accreditation does not guarantee regulatory compliance. Penetration testing can support compliance by identifying security weaknesses, but you must also meet the applicable framework’s other requirements.
