How do I check a cybersecurity consultancy’s reports and past engagements before buying?

Start with the reports. Ask for samples with client names and sensitive details removed. A strong report names the problem, explains why it matters, ranks it, and tells the reader what to do. A weak one reads like a list of automatic scan results with the company name on top. Ask who wrote each report and whether that person is staying.

Then look at the engagement list. What types of work does the firm do, how long did each last, and how much was repeat business? Repeat clients are a good sign, but so are clients who bring in the firm after an incident. Ask how the firm handled disagreements, such as a client who disputed a finding.

Finally, check how the firm treats confidentiality itself. How does it store reports, and who can open them? A consultancy that guards clients’ secrets carelessly is a problem you would own. Ask your lawyer what the contracts allow the firm to share with you. Baseline guidance on small-organization security, published by a government body, is a useful yardstick for judging the firm’s own practices. Ask also whether any client has disputed a report.

Key takeaways

• Read redacted sample reports, and ask who wrote them.
• Look for repeat clients as well as one-off engagements.
• Check how the firm stores and protects its own reports.
• Ask what client contracts let the firm disclose to you.