Research starting points
Penetration testing providers.
An initial directory of researched candidates, with a useful question to ask each. Coverage is expanding; these entries are not test scores or a complete market ranking.
HackerOne
Retesting documentation provides a concrete post-test buying question.
Ask this
Which remediation period applies to the proposed engagement?
Cobalt
Package and contract retesting language needs offer-specific confirmation.
Ask this
Which retesting window governs this package and contract?
NetSPI
Lists web, API and mobile application testing among service areas.
Ask this
How will the proposed work cover our application roles and APIs?