From personal experience having worked with multiple "enterprise-grade" pentest vendors (including NCC), I think the entire pentest industry is overdue for a big shake-up.
Well it's going into the trash compactor along with all the other jobs that are highly vulnerable to automation with LLMs, but at the same time LLMs have spawned a panic buying spree of AI pentesting contracts. It's going to be a wild ride before the dust settles.
yeh running some automatic scripts against public urls to check if https is enabled and scanning if there are public s3 buckets is barely any better than a security linter.
There are some teams that are better than this, but they are rare.
The press release speaks of "a rigorous source-code security assessment by NCC Group." That suggests more than a bit of url scanning. Somebody is lying, that much is certain.
Where does one go for a trustworthy pentest or security review? Especially, where do smaller companies perhaps go that aren't at the multi-million level.
I can recommend https://includesecurity.com/ , they're very reasonably priced and will probably catch any glaring issues you have, but they probably won't catch any subtle issues on their entry-level pricing.
