An internal pentesting team is a good practice of enterprise cyber security, but hiring a third-party pentesting firm might be necessary for several reasons. Cyber security compliance standards require a third-party service provider to ensure system owners and pentesters have no conflict of interest. And sometimes, companies do not have the necessary resources on board, as hiring security experts might be too expensive.