Before buying a pen test, it is good to map your systems. This is done to identify which critical information assets and systems you have and where in the network they are located. When you have that overview in front of you, you know what is worth protecting and which system or part of the network that should be tested. When choosing a supplier, you must always ensure that the penetration testers are certified testers who follow the methods and frameworks that apply to the market, such as OWASP and OSSTMM. The result of the penetration test will never be better than the penetration tester himself.