I want to hire someone to do a security audit of my website but I'm not sure how to go about it. Where are good places to look for an auditor? Besides a list of referrals, what should I be looking for in an auditor? What qualifications should he/they have, and how can I verify them?

  • 2
    Just to be clear, is there a specific kind of security audit you need? For example for PCI compliance or something else? Dec 15, 2011 at 14:58
  • I'm looking for something general -- I'm a solo developer and don't have anyone to review my code, but even if I did, I'd still want someone who knows more about security to bang on things. I know enough (I think) to prevent SQL injection attacks, but I don't know what else I need to be worried about. Someone, somewhere, must specialize in this stuff. Who is he, how do I find him, and how do I tell if he's any good? Dec 15, 2011 at 18:12

2 Answers 2


I'm going to suggest that you get yourself a copy of nessus and run the scans yourself. It should give you a good baseline to start with.

Why? Because many third party auditors are going to run this exact tool and won't really help you with interpreting the results any way.

If you use certain Verisign certificates, Symantec throws in some baseline vulnerability scanning as part of the cost. Other CAs may provide some of these services as well.

If you have a specific requirement like PCI Compliance, you can get a list of authorized scanning vendors with the caveat being that scanning results don't necessarily come with vulnerability management support (unless you pay extra).


There are IT security certificate issuing firms. I cant give a statement on the acceptance of those or on the skillset required.

Maybe a google search on "IT security certificates" reveals more information or a start for deeper DD.

A professional pentester/auditor should be able to prove the knowledge by such a certificate, a real diploma and/or job references.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.