Here is an uncomfortable truth about the security industry: penetration testing is largely unregulated. Anyone can set up a website, call themselves an ethical hacker and start selling tests, regardless of their actual skill, their methods or how carefully they handle your most sensitive data. For a business trying to choose a provider, that is a genuine problem. How do you tell a rigorous, trustworthy firm from someone running an automated scan and calling it a penetration test?

This is exactly the gap CREST accreditation exists to close. When you understand what CREST accreditation actually is, and what a provider has to prove to earn it, it becomes one of the most reliable signals of quality you can look for. This guide explains what CREST is, the important difference between accreditation and certification, what an accredited firm has genuinely demonstrated, and how to check a provider’s status before you sign anything.

What is CREST?

CREST, the Council of Registered Ethical Security Testers, is an international not-for-profit accreditation and certification body for the technical cyber security industry. Founded in the UK in 2006, it now represents more than 500 member companies worldwide and has established chapters across the Americas, Europe, Asia and Australasia. Its purpose is to raise and maintain standards of professionalism, competence and ethics among the companies and individuals who deliver security testing.

Although penetration testing is the discipline most people associate with CREST, its accreditation actually spans several service areas, including vulnerability assessment, threat intelligence, incident response and security operations centres. A firm is accredited for the specific disciplines it has been assessed in, which is an important detail we will return to when we look at how to verify a provider.

What a CREST-accredited company has actually proven

Company accreditation is where much of the real protection for buyers lives, because it looks well beyond technical ability. To achieve and keep it, a firm has to open up its entire operation to independent scrutiny. The assessment typically examines:

• Testing methodology: evidence that engagements follow a consistent, documented and professional process, from scoping through to reporting
• Data security and handling: how the firm protects the sensitive information it inevitably comes into contact with during testing
• Personnel security and development: vetting of staff and a commitment to their ongoing training and competence
• Insurance and contracts: appropriate professional indemnity cover and sound contractual terms
• Code of conduct and ethics: a binding commitment to professional, legal and ethical behaviour
• Complaints and recourse: a formal route to escalate to CREST if the provider falls short, which you simply do not have with an unaccredited supplier

Crucially, accreditation is not a badge you earn once and keep forever. Member companies must reapply each year and undergo a fuller reassessment periodically, so standards are maintained over time rather than claimed and forgotten.

CREST also refreshes its underlying standards as the industry evolves, updating its penetration testing accreditation standard in 2025 to reflect current best practice across preparation, scoping, execution and continuous improvement. In other words, an accredited firm is being held to a moving, modern benchmark, not a decade-old checklist.

Why it matters when choosing a provider

With the mechanics covered, here is why all of this should influence your decision.

It replaces trust with verification

In an unregulated market, accreditation lets you rely on an independent assessment rather than a sales pitch. You are not taking a provider’s word for their competence, their process or their ethics, because a respected third party has already examined them.

It gives you consistency and quality

Accredited firms follow documented, repeatable methodologies, which means the quality of your test does not hinge on who happens to be free that week. You can expect thorough testing and a clear, useful report with practical remediation advice.

It protects your data and gives you recourse

Penetration testers handle deeply sensitive information. Accreditation confirms that a firm has been assessed on how it safeguards that data, carries proper insurance, and can be held to account through a formal complaints process if something goes wrong.

It supports your compliance and contracts

Using a CREST-accredited provider aligns neatly with obligations under standards such as ISO 27001, PCI DSS, the UK GDPR and, for financial services, DORA. Cyber insurance underwriters increasingly expect testing from accredited providers, and procurement teams at large enterprises and public sector bodies frequently specify CREST accreditation as a minimum requirement. Choosing an accredited firm keeps doors open rather than closing them.

It builds stakeholder trust

Being able to say your testing was carried out by a CREST-accredited firm reassures your own customers, partners and board that you take security seriously and that your results are credible and independently verifiable.

CREST and NCSC CHECK: how they relate

If you procure security services in the UK, you will also come across CHECK, a scheme run by the National Cyber Security Centre. It is easy to assume the two compete, but they serve different purposes. CHECK approves firms to test UK government and public sector systems classified at OFFICIAL and above, and its team members hold recognised qualifications, including CREST certifications.

In practice, CREST certifications act as a qualification pathway into CHECK rather than a rival to it. The simple rule of thumb is this: for UK government systems you need a CHECK provider, and for commercial systems, CREST company accreditation is the signal to look for. Many established firms hold both.

How to verify a provider’s CREST status

Because “CREST” gets used loosely in marketing, it pays to check claims yourself rather than take a logo at face value. Before you commit, run through this short checklist:

• Search the official CREST Marketplace by the provider’s exact registered legal entity name, not just its trading or brand name
• Confirm the discipline listed on the profile actually includes penetration testing, rather than a different service
• Check the region the accreditation applies to, particularly for international groups with multiple entities
• Ask who will do the work and which CREST certifications those named individuals hold
• Request a sample report so you can judge the clarity and usefulness of the deliverable
• Do not confuse a claim that individuals are certified with the company itself being accredited

A credible provider will welcome these questions and answer them openly. Hesitation or vagueness is itself a useful signal.

Choosing your provider with confidence

In a field where anyone can claim expertise, CREST accreditation gives you something rare: independent, ongoing proof that a provider meets high technical, ethical and legal standards, handles your data responsibly, and can be held to account. It will not replace your own due diligence, but it is one of the clearest quality signals available and a sensible baseline to insist on.

CodeShield is a CREST-accredited penetration testing provider, which means our methodology, our data handling and our team’s competence have all been independently assessed against a rigorous, current standard.

If you would like testing you can trust, and results that stand up to auditors, insurers and enterprise customers alike, get in touch to discuss your requirements and scope the right engagement for your organisation.