MSPs don't buy penetration testing the way a single company does — you're scoping, scheduling, and reporting across a portfolio of client environments, each with its own risk profile, contract, and Cyber Essentials Plus or ISO 27001 renewal date. Get the test type and cadence wrong for even one client and you're the one explaining the gap to their auditor.
Why this matters
MSPs resell trust, not just infrastructure. When a client fails an audit because their "penetration test" was actually an automated vulnerability scan, that failure lands on you, not just them.
Multiply that risk across 20, 40, or 100 client environments and one sloppy testing vendor can undo a book of business. In 2026, more clients are asking for penetration test evidence as part of vendor due diligence, procurement questionnaires, and Cyber Essentials Plus renewal — which means your testing supply chain has to hold up under scrutiny, not just tick a box once a year.
Who this is for
This guide is for MSP owners and security leads managing penetration testing across a multi-client book — whether you're reselling tests as an add-on, coordinating third-party testers on behalf of clients, or building an internal testing practice to support Cyber Essentials Plus and ISO 27001 renewals. If you're testing a single environment, most of the multi-tenant logic below won't apply to you.
What to look for in penetration testing for MSPs
1. Multi-tenant reporting across your client book
A single PDF per client doesn't scale past a handful of accounts. You need a way to see remediation status across every client at once, not open 40 separate reports every quarter to check who's still exposed.
Before you sign with a testing vendor, ask how they structure reports for MSPs with recurring multi-client contracts. If the answer is "one template, no rollup view," that's a red flag for anyone managing more than a handful of accounts.
2. CREST or CHECK accreditation
Accreditation isn't paperwork — it's the difference between a manual test and an automated scan with a summary bolted on. CREST-registered and CHECK-approved testers follow documented methodologies that auditors recognise on sight.
If a client's contract or a government framework like G-Cloud specifies an accredited tester, an unaccredited report gets rejected outright, and you're back to square one with a renewal deadline closing in.
3. Retesting included in the scope
Many contracts quietly exclude retesting after remediation, which means the vendor gets paid to find problems but not to confirm you fixed them. That gap matters more for MSPs, because you're the one fielding the client's "is this actually resolved?" question.
Before committing budget, work through how to scope a penetration test so retesting, reporting format, and turnaround are locked in the contract, not negotiated after the findings land.
4. Turnaround time that matches your renewal calendar
Cyber Essentials Plus and ISO 27001 surveillance audits run on fixed 12-month cycles. A tester who takes six weeks to deliver a report doesn't fit an MSP juggling staggered renewal dates across 30-plus clients.
Ask for typical turnaround in writing — most CREST-accredited external tests deliver findings within 5 to 10 working days of the test window closing. Anything slower needs to be scheduled well ahead of the client's certification deadline.
5. Evidence format that plugs into your compliance stack
A test report sitting in someone's inbox isn't evidence an auditor can use quickly. The report needs to slot into whatever system tracks certifications, remediation, and renewal dates across your client portfolio.
This is where compliance automation software for MSPs earns its keep — centralising pentest findings alongside Cyber Essentials and ISO 27001 evidence so nothing gets buried in a client-specific folder nobody checks until renewal week.
6. Per-client pricing, not flat enterprise rates
Flat enterprise pricing assumes one large environment. MSPs need per-client or per-seat pricing that scales down for a 15-person client and up for a 200-person one, without forcing every account onto the same invoice size.
Get pricing broken out per environment before you commit, so you can pass costs through transparently instead of eating margin on smaller clients.
The tests worth buying
External infrastructure test — the baseline you can't skip. Every client with an internet-facing footprint needs this annually at minimum. It covers public IP ranges, exposed services, and firewall configuration. Verdict: Buy — for every client, every year.
Internal network test — the one clients try to skip. Simulates what happens after a breach: lateral movement, privilege escalation, access to sensitive data once an attacker is already inside. Regulated clients (finance, healthcare, NHS suppliers) should treat this as mandatory, not optional. Verdict: Buy for high-risk clients, Consider for the rest.
Web application test — for clients shipping their own software. OWASP Top 10-based testing catches injection flaws, broken authentication, and access control issues in client-built platforms. Skip it for clients with no custom-built web apps — it's wasted spend. Verdict: Consider, scoped per client.
Cloud configuration review — the gap generic tests miss. Microsoft 365 and AWS misconfigurations don't show up in a traditional network pentest. This is a distinct engagement, and by 2026 it's the fastest-growing add-on request from MSP clients moving fully to cloud. Verdict: Buy for cloud-heavy clients.
Social engineering and phishing simulation — the cheap add-on with the highest payoff. Costs a fraction of a full infrastructure test and consistently surfaces the weakest control most MSPs have across their book: staff clicking the wrong link. Pair findings with a vulnerability and patch management workflow so remediation doesn't stall after the report lands. Verdict: Consider as a standing add-on.
What to avoid
- A vulnerability scan rebranded as a penetration test. No manual exploitation, no context on real-world exploitability — just a scanner output with a cover page. It won't satisfy Cyber Essentials Plus or an ISO 27001 surveillance audit.
- One report template stretched across every client. A 15-person client and a 200-person client don't have the same attack surface. A single template either over-scopes the small client or under-scopes the large one.
- No retest clause in the statement of work. Without it, you're paying for findings, not for confirmation the findings got fixed — and that's the exact gap an auditor will flag.
Centralise pentest evidence across every client
OneClickComply keeps certifications, evidence, and renewal dates in one place across your book.
Verdict comparison table
| Test type | Best for | Typical frequency | Accreditation needed | Verdict |
|---|---|---|---|---|
| External infrastructure | Every client with internet-facing assets | Annual | CREST/CHECK | Buy |
| Internal network | Regulated or high-risk clients | Annual to quarterly | CREST/CHECK | Buy (high-risk) |
| Web application | Clients shipping their own software | Per release cycle | CREST | Consider |
| Cloud configuration | Cloud-heavy clients (M365, AWS) | Annual | Specialist tester | Buy (cloud clients) |
| Phishing simulation | All clients, low cost | Quarterly | None required | Consider |
For multi-tenant tracking, pair test results with a vendor risk management software for MSPs setup so remediation status doesn't live in a spreadsheet nobody updates after month one.
Frequently asked questions
One last thing
Cyber Essentials Plus doesn't actually require a full penetration test — it requires an external vulnerability scan plus a sampled internal device check. MSPs routinely oversell a full pentest engagement to clients who only needed the lighter Cyber Essentials Plus assessment, which burns budget clients could have spent on the internal or cloud testing they actually needed. Know which certification is asking for what before you quote the bigger engagement.