When two VAPT providers survive technical and commercial evaluation, the final decision should not collapse into price, brand familiarity or the most polished presentation. Both may be capable, yet differ materially in assigned people, evidence quality, operational discipline, specialist depth and the effort required to reach verified closure.
The buyer needs a short, evidence-led decision process that preserves earlier evaluation work. Reopen only genuinely unresolved differences, normalize the final offer and record the trade-off that the approving stakeholders are accepting.
Reconfirm the decision objective
Write one sentence describing what the engagement must enable: remediation of a release, customer assurance, regulatory evidence, a production risk decision or another defined outcome. The preferred vendor can change when the relying party and consequence change.
Confirm the final scope baseline and mandatory date. Do not compare proposals that now assume different targets, identities, testing depth or report recipients.
- Assurance purpose and relying parties.
- Critical release or audit dates.
- Highest-impact technologies and workflows.
- Required evidence and closure outcome.
Apply mandatory gates before scoring
A high weighted score must not compensate for missing authorization, an unmanaged conflict, unsafe production practice or an unacceptable evidence process. Mark these as pass, conditional pass or fail.
Conditions need an owner and deadline before award. If the vendor cannot accept a mandatory gate without changing the offer, treat that as a revised proposal rather than a minor clarification.
- Legal authority and target permission.
- Named team, subcontractors and conflicts.
- Rules of engagement and escalation.
- Confidentiality, evidence handling and deletion.
Use the scorecard created before the presentations
Retain the weights issued before finalists were known. Reweighting after seeing prices or personalities creates a decision that is difficult to defend and easy to manipulate.
Each evaluator should score independently from cited evidence, then reconcile material differences. Replace adjectives such as excellent or experienced with proposal sections, scenario answers, sample findings or verified references.
- Method and coverage fit.
- Assigned technical capability.
- Evidence and reporting quality.
- Operational delivery and governance.
Compare the named people who will deliver
Evaluate the proposed lead and specialists, not the company’s general résumé. Confirm availability, employment relationship, location, relevant platform experience and direct participation in evaluation calls.
Ask what happens if a named person becomes unavailable. A credible continuity plan preserves capability and requires buyer approval for substitution rather than quietly replacing senior evaluators after award.
- Lead tester is identified and interviewed.
- Specialist coverage matches the scoped technologies.
- Quality reviewer has real decision authority.
- Replacement standard is contractual.
Revisit the decisive technical scenario
Choose one scenario tied to the most important risk and ask both finalists the same final questions. Do not conduct an entirely new assessment; use the exercise only to resolve an evidenced gap.
Compare how each team identifies prerequisites, test identities, safe proof, authoritative effects, limitations and retest. A correct vocabulary list is weaker than a method that can be executed in your environment.
- Architecture and trust boundaries understood.
- Identity, tenant and workflow states covered.
- Safety and stop conditions explicit.
- Evidence and root cause are reproducible.
Compare sample-report usefulness
Use the already reviewed synthetic samples. Trace one finding from executive consequence to technical evidence, remediation and closure test.
Prefer the provider whose deliverable reduces ambiguity for both leadership and engineering. A visually polished document cannot compensate for missing coverage, weak proof or generic remediation.
- Scope and limitations are candid.
- Findings contain control and prohibited cases.
- Severity reasoning is consistent.
- Retest criteria are observable.
Assess delivery risk and buyer effort
Consider access preparation, project management, communication cadence, critical escalation, dependency handling and report-review cycles. The cheapest provider may require more internal coordination or produce slower decisions.
Record the buyer resources each offer assumes. A vendor that needs constant endpoint explanations, manual evidence reconstruction or repeated factual corrections shifts hidden cost onto security and engineering teams.
- Readiness and kickoff plan.
- Named communication and escalation channels.
- Dependency and blocked-time management.
- Expected internal stakeholder hours.
Normalize total cost to verified closure
Compare currency, tax, base scope, options, travel, retest cycles, change units and payment milestones. Add predictable exclusions and buyer effort rather than comparing only the opening fee.
A higher total can be justified by specialist depth or stronger closure, while a lower total can be efficient when coverage is genuinely equivalent. Require a written explanation for every material price difference.
- Same technical baseline and assumptions.
- Included and additional retest cycles.
- Likely change requests and specialist options.
- Payment tied to accepted deliverables.
Perform focused due diligence
Verify references for engagements similar in technology, risk and operating conditions. Ask about assigned-team quality, evidence usability, schedule reliability, critical communication and retesting—not whether the customer generally liked the company.
Reconfirm sanctions, insurance where required, ownership, conflicts, subcontractors and data location. Due diligence should test the claims that actually affect your decision.
- Comparable reference context.
- No unapproved delivery-chain changes.
- Current conflict declaration.
- Security and evidence controls confirmed.
Resolve ties with risk, not preference
If scores remain close, identify the one or two consequences that differ. For example, one vendor may have stronger mobile depth while another has better production controls. Ask which shortfall is harder for the buyer to mitigate.
Do not invent decimals to manufacture certainty. Record the residual trade-off, compensating buyer action and accountable approver.
- List only material unresolved differences.
- Estimate impact if each difference becomes real.
- Identify buyer-side mitigation and its cost.
- Select the trade-off aligned to the assurance purpose.
Write a concise decision record
The record should state finalists, mandatory gates, weighted result, decisive evidence, normalized cost, due diligence, accepted conditions and approvers. Preserve it with the final contract pack.
Notify both finalists professionally without exposing competitor confidential information. Feed useful lessons into the next procurement while leaving the original evaluation intact.
Use NIST SP 800-115 to anchor assessment planning, rules and reporting, and the OWASP Web Security Testing Guide to test whether method claims translate into practical coverage. Apply your organisation’s procurement, legal and regulatory decision requirements.
Make the final choice explainable later
A strong selection is not one that eliminates every difference. It makes the important differences visible and assigns the resulting risk consciously.
WIMD combines mandatory gates, evidence-weighted scoring, named-team validation, normalized cost and a compact decision record so the selected provider remains defensible when the engagement is audited or challenged.