How to Choose a Website Security Consultant: Credentials, Questions and Red Flags

Choose a website security consultant by matching three things to your need: the kind of work (a scan, a penetration test, an assessment or advice), the evidence they can show (a written scope, a sample report, credentials you can verify) and how they handle what they find. Credentials help you judge knowledge, but none of them guarantees the work. A clear written scope and a report you can act on matter more.

Most small businesses and local governments don't need the biggest firm or the longest list of letters after a name. They need someone who will look at their actual site, hosting and vendors, explain the findings in plain language, and tell them what to fix first.

This guide explains what the common credentials mean according to the bodies that issue them, the difference between the main types of security work, the questions to ask and the red flags that should end the conversation.

First, Decide What Kind of Help You Need

NIST's long-standing testing guide, SP 800-115 (September 2008, still the current final version), gives useful definitions:

Many small organizations start with an assessment because it covers hosting, CMS and plugins, access, backups and third-party scripts in one pass. Our website security assessment guide explains the scope, and what website security consulting is covers the advisory side.

What the Common Credentials Mean

Each description below comes from the issuing body's own page, checked in October 2026. Requirements and exam outlines change, so check the official page before relying on a detail.

CISSP (ISC2)

ISC2 says earning the CISSP "proves you have what it takes to effectively design, implement and manage a best-in-class cybersecurity program." It requires five years of work experience, covers eight domains including "Security Assessment and Testing," and is accredited under ISO/IEC 17024 by ANAB. ISC2 says a new exam outline takes effect on 15 April 2027. CISSP signals broad security management knowledge. It is not a hands-on testing credential.

CISM (ISACA)

ISACA describes CISM as affirming "your ability to assess risks, implement effective governance, and proactively respond to incidents." It is a management credential. ISACA says the CISM exam content outline will be updated effective 3 November 2026.

CISA (ISACA), not the federal agency

The Certified Information Systems Auditor is, in ISACA's words, "the standard of achievement for auditing, monitoring, and assessing IT and business systems." It has nothing to do with the Cybersecurity and Infrastructure Security Agency, which is also called CISA. A CISA holder is trained in audit, which is useful when you need controls checked against a standard.

OSCP and OSCP+ (OffSec)

OffSec's PEN-200 is its "hands-on ethical hacking and penetration testing certification course." Passing it earns the OffSec Certified Professional (OSCP), which OffSec recognizes for life, plus the OSCP+, which is valid for three years. This is a practical testing credential.

GIAC GPEN

The GIAC Penetration Tester (GPEN) "validates a practitioner's ability to properly conduct a penetration test employing effective techniques and methodologies." GIAC offers other certifications too, so ask which one a tester holds.

CREST

CREST calls itself a "Global Cyber Security Accreditation Body." It is a UK-registered not-for-profit that accredits supplier companies, and its site has a "Find a Supplier" search. CREST membership describes a company, not a person.

PCI QSA and ASV

PCI SSC says Qualified Security Assessor companies "are independent security organizations that have been qualified by the PCI Security Standards Council to validate an entity's adherence to PCI DSS." A separate program, Approved Scanning Vendors (ASVs), covers the external vulnerability scans required by PCI DSS Requirement 11.3.2. If your bank or payment processor asks for a QSA or ASV, only a listed company will do.

How to Verify a Credential

1. Ask for the person's full name, the credential and, where the issuer uses one, a certification number.
2. Check it with the issuing body. ISACA has a "Verify a Certification" page, GIAC publishes a certified holder directory, CREST has a supplier search and PCI SSC lists QSA and ASV companies.
3. Confirm the credentialed person will actually do or supervise your work, not just appear on the firm's website.
4. For company programs (CREST, QSA, ASV), confirm the listing is current and covers the service you are buying.

Questions to Ask Before You Hire

Send these in writing and compare the answers side by side.

• Scope: What exactly will you test or review? The website, the hosting account, the CMS and plugins, admin access, backups, third-party scripts, DNS and email?
• Method: Is this an automated scan, a manual test or both? Which standards do you map findings to (for example NIST CSF 2.0, OWASP Top 10:2025, CIS Controls v8.1)?
• Permission and safety: Will you give us written rules of engagement? How do you avoid taking the live site down? Who must approve the test if our host or platform owns the server?
• Deliverables: May we see a redacted sample report? Does it rank findings by risk and explain fixes in plain language?
• People: Who will do the work, what are their credentials, and is any of it subcontracted?
• Data: What data of ours will you access, where will you store it and when will you delete it?
• Follow-up: Is a retest of fixed issues included? Who do we call if you find something urgent during the work?
• Independence: Do you sell products or hosting you might recommend? If so, how do you handle that conflict?
• Timely example: How would you have checked our exposure to a flaw like PHP2Shell, including systems our vendors run?

If you are also reviewing a host or agency, our vendor security review guide has a questionnaire you can reuse.

Red Flags

• Guarantees. "Hack-proof," "100% secure" or "guaranteed compliance." No honest tester can promise that.
• No written scope or permission. Testing without written authorization exposes you and your host. A professional asks for it before starting.
• Unsolicited "we found vulnerabilities on your site" emails. A stranger who has already scanned or tested your site without permission is not someone to hire. See what to do when someone says AI found vulnerabilities on your website.
• A scanner printout sold as a penetration test. If the sample report is raw tool output with no human analysis, you are buying a scan.
• Compliance shortcuts. A "PCI certificate" from a company that is not a listed QSA, or a promise of a fast and easy SOC 2. The AICPA itself has warned that "Promises of 'fast and easy' threaten SOC credibility" (February 2026).
• Credentials you can't verify. Logos without names, or names that don't appear in the issuer's records.
• Fear-based pressure. Urgent deadlines, doom forecasts or a refusal to explain findings until you sign.
• No plan for urgent findings. If they find an active compromise, they should tell you immediately and help you start a response, not wait for the final report.

Right-Sizing for Small Businesses and Small Governments

A small organization usually needs a focused engagement, not an enterprise program. A good fit:

• Starts with a scoped assessment of the website and its vendors, then a short prioritized fix list.
• Uses a recognized baseline. CIS describes Implementation Group 1 (IG1) as "the on-ramp to the CIS Controls," with 56 safeguards for organizations "with limited IT and cybersecurity expertise."
• Tells you about free resources you qualify for. CISA's Cyber Hygiene scanning is free for state, local, tribal and territorial governments and critical infrastructure organizations.
• Works with your web developer and host instead of replacing them.
• Leaves you with written findings you own and can hand to another vendor.

If you mainly need someone on call when something goes wrong, compare incident response retainers. If you need the fixes done, not just advice, that is implementation work, such as our website security services. And if you want to start on your own, our website security checklist covers the basics.

Writing the Engagement Down

Before work starts, the written agreement should name:

1. The systems in scope and out of scope, by domain name and account.
2. The type of work (scan, test, assessment, advice) and the standards used.
3. Testing windows, contacts on both sides and how to stop testing in an emergency.
4. Written authorization from you and, where needed, from your host or platform.
5. The deliverables, including the report format and any retest.
6. Confidentiality, data handling and deletion.
7. Fees and what counts as extra work.

For card payments, add how the work relates to your PCI DSS obligations. Our PCI DSS 4.0 website guide explains the payment-page script requirements most stores now have to meet.

Conclusion

Pick the type of work first, then the person or firm. Use credentials as evidence of knowledge, verify them with the issuing body, and judge the consultant mainly on the scope, the sample report and how clearly they answer your questions. Avoid anyone who guarantees results, skips written permission or pressures you. If you want a scoped assessment or a second opinion on another firm's proposal, our website security consulting team can help.

Frequently Asked Questions