How to verify a vendor’s penetration testing certification

Hiring a penetration testing vendor is a significant security decision, and the credentials a vendor presents should be verifiable before you sign anything. Certifications like OSCP, CREST, CHECK, and GPEN carry real weight in the industry, but they are also easy to misrepresent. Knowing how to verify penetration testing credentials protects your organization from engaging a vendor who lacks the technical depth your engagement demands. This guide walks you through the full verification process, from gathering the right information to spotting fraudulent claims.

What to Gather Before Checking Credentials

Before you open any certification registry, collect the specific details the vendor has provided. Verification only works when you have precise information to compare against official records. Vague claims like “our team is certified” cannot be checked until you have names and certification identifiers in hand.

• Full legal name of the vendor organization
• Names of the individual testers assigned to your engagement
• Certification names and issuing bodies (for example, OSCP issued by OffSec, or CREST membership issued by CREST International)
• Certification or membership ID numbers, if the vendor has provided them
• The scope of your intended engagement (internal network, web application, red team exercise, and so on)

Request this information in writing before the verification step begins. A reputable vendor will provide it without hesitation. If a vendor is reluctant to share certification identifiers or tester names, treat that reluctance as an early warning sign.

Locate the Official Certification Body’s Registry

Every credible penetration testing certification is backed by an issuing body that maintains a public or verifiable register of certified individuals and companies. Knowing where to look is the foundation of the entire process.

The most widely recognized bodies and their lookup tools include:

• CREST International: Maintains a searchable member company register and a certified individual register at crest-approved.org
• OffSec (OSCP, OSEP, OSED): Does not publish a public registry, so verification must be requested directly from OffSec using the candidate’s certificate ID
• GIAC (GPEN, GWAPT, GXPN): Offers a public credential verification tool at giac.org/verify
• CHECK (NCSC UK scheme): Verified through the NCSC’s approved company list, available on the NCSC website
• EC-Council (CEH, CPENT): Provides a public verification portal at aspen.eccouncil.org/VerifyBadge

Bookmark the official domain of each relevant body before you proceed. Fraudulent vendors sometimes create convincing lookalike pages, so confirming you are on the correct domain is a step worth taking consciously.

Run the Vendor Lookup and Read the Results

Navigate to the official registry and enter the information you gathered. For organizational certifications like CREST membership, search by company name. For individual certifications like OSCP or GPEN, search by the tester’s full name or certificate ID.

1. Enter the company or individual name exactly as the vendor provided it, including any legal suffixes
2. Cross-reference the certificate ID number if the registry supports it, as name searches can return partial matches
3. Read the full result entry, not just the name match, paying attention to certification tier, status, and listed scope
4. Screenshot or save the result page with a timestamp for your records

After completing the lookup, you should see a confirmed record that matches the vendor’s claim. If the search returns no result, a different company name, or a status other than active, do not assume it is a database error. Proceed to the cross-check step and consider contacting the certification body directly to confirm.

Cross-Check Certification Scope Against Your Engagement

A valid certification is only useful if it covers the type of penetration testing you need. Many certifications are scoped to specific disciplines, and a vendor certified in one area may not hold credentials relevant to your engagement.

Compare the certification’s defined scope with your engagement requirements:

• Web application testing requires different credentials than infrastructure or network testing
• Red team exercises and social engineering engagements often require separate or higher-tier certifications
• CREST, for example, distinguishes between infrastructure, web application, and simulated attack specialists at different assessment levels
• CHECK certification applies specifically to government and public sector engagements in the UK and has its own scope conditions

If your engagement involves cloud environments, OT/ICS systems, or mobile applications, ask the vendor explicitly which certification covers that domain and verify it separately. A mismatch between certification scope and engagement scope is one of the most common oversights in vendor selection, and it can leave critical areas of your environment inadequately tested.

Confirm Certification Validity and Expiry Dates

Most penetration testing certifications expire or require periodic renewal. A certification that was valid two years ago may no longer reflect the vendor’s current standing or the tester’s maintained competency.

1. Check the expiry date shown in the registry record or on the certificate the vendor provided
2. Confirm that the certification will remain valid for the full duration of your engagement, not just at the point of signing
3. For certifications that require continuing professional development (CPD), ask the vendor to confirm that renewal requirements have been met
4. If the registry shows an expiry date that has already passed, contact the certification body to ask whether a renewal is pending or the certification has lapsed

An expired certification that a vendor presents as current is a serious misrepresentation. Even if unintentional, it signals a lack of attention to compliance detail that should give you pause before proceeding with an engagement.

Red Flags That Indicate a Fraudulent or Misrepresented Certification

Once you have completed the verification steps, you are in a position to evaluate what you found. Some discrepancies are minor administrative issues; others indicate deliberate misrepresentation. Knowing the difference matters.

Watch for these specific warning signs:

• No registry match: The certification body has no record of the individual or company under any variation of the name provided
• Scope mismatch: The certification exists but covers a different discipline or tier than the vendor claimed
• Expired status presented as current: The registry shows a lapsed certification that the vendor described as active
• Refusal to provide certificate IDs: A legitimate vendor has no reason to withhold verifiable identifiers
• Certificates that cannot be traced to a recognized body: If you cannot find the issuing organization through independent research, the certification may be from an unaccredited or self-issued source
• Inconsistencies between the certificate document and the registry: Different dates, different names, or different certification levels between what the vendor sent and what the registry shows

If you encounter any of these flags, do not proceed on the assumption that there is a simple explanation. Pause the vendor selection process and request a direct clarification in writing. If the vendor cannot resolve the discrepancy with documentation from the certification body, that vendor should be removed from consideration.

Verifying penetration testing credentials takes less than an hour and can prevent a costly engagement with a vendor who lacks the expertise your security posture requires. If you would like guidance on evaluating vendors or structuring a penetration testing engagement, contact us and we will help you move forward with confidence.