Red Flags to Watch for When Hiring a Cybersecurity Company

The cybersecurity industry has a credibility problem. The low barrier to entry and high demand for services has attracted vendors who over-claim, underdeliver, and sometimes lack the technical capability they advertise.

Knowing the warning signs before you engage a provider can save you from a costly mistake.

They guarantee they'll make you 'unhackable'

No credible cybersecurity provider guarantees that your organisation will never be breached. Security is risk reduction, not risk elimination. Any vendor who promises complete protection or claims to make your systems 'unhackable' is either not being honest with you or does not understand how security works.

Reputable providers talk about reducing your attack surface, detecting threats faster, and improving your ability to respond. They do not make guarantees they cannot keep.

They can't explain their methodology

If you ask a vendor how they'll approach your engagement and receive a response full of buzzwords but no substance - 'we use cutting-edge AI-powered threat intelligence' - that's a warning sign. Experienced security professionals can explain their methodology clearly and concisely.

Ask follow-up questions: what frameworks do you follow? What tools do you use and why? What does your testing process look like step by step? The answers will tell you quickly whether there's real depth behind the pitch.

They won't share sample deliverables

Any reputable provider should be able to share a redacted sample report or deliverable. Refusing to do so - citing confidentiality when a redacted sample would be perfectly acceptable - suggests the deliverables are not something they're proud of.

They pressure you to sign quickly

Artificial urgency - 'we have a slot available this month but it won't last' or 'this pricing is only valid for 48 hours' - is a pressure sales tactic. Cybersecurity engagements are significant investments. Any provider who rushes you into a decision before you're ready to make one is prioritising the sale over your interests.

Their pricing is suspiciously low

A penetration test quoted at a fraction of the market rate should prompt questions, not excitement. Either the scope is significantly narrower than you think, the testing is largely automated rather than manual, or the team executing it lacks the experience you need.

Ask exactly what is included in a low-cost quote and compare it carefully against mid-market proposals. Cheap security assessments often deliver cheap insights.

They can't name the team who will work on your account

If a vendor is unable or unwilling to tell you who will actually work on your engagement, ask why. In a legitimate firm, this should be a straightforward question to answer. An inability to name delivery staff often signals over-reliance on subcontractors, high turnover, or a stretched team.

Their certifications don't hold up to scrutiny

Company-level certifications like ISO 27001 tell you about a vendor's internal processes, not their technical capability. Ask for the individual certifications of the staff assigned to your work. If a provider claims CREST or OSCP-certified testers, ask for names and verify the credentials.

There are no verifiable references

Ask for references from current clients in a similar industry or of a similar size to your organisation. A vendor who can't provide references - or provides generic testimonials without names or organisations attached - may not have the client history they're implying.

Find verified providers on CyberAtlas

CyberAtlas lists verified Australian cybersecurity companies across every major category and city. Each listing is reviewed before publication. Browse the directory to build a shortlist of reputable providers, then apply your own due diligence before engaging.