Hey Ken, hope you guys the best, good project.<p>As a seasoned (although retired) pen-tester I wanted to say you&#x27;ll have some serious problems with rating when it comes to results.<p>When a company hires pen-testers and pen-testers do or do not find stuff, the company has no idea about the coverage. So the pen-test team might have missed many stuff or identified all. I&#x27;m sure you&#x27;ve seen in real world even the same members of the same pen-test team might find different issues for the same test.<p>Therefore one of the biggest problems is to actually knowing whether they are good or not at what they do. It&#x27;s easy to rate communication skills, responsiveness, attitude, report quality etc. But very hard to rate the quality of the results (which is the real reason for carrying out a pen-test).<p>When they don&#x27;t find something, maybe there really is nothing there.
When they found something, maybe there is more there. The customer has no idea at that point. It&#x27;ll be only a fair amount of time later they&#x27;ll figure out the coverage &#x2F; vulnerability finding quality.<p>I&#x27;m sure in the long run market will stabilize (assuming you can change your rating for a pen-tester even after a year) but this is something to consider.<p>Update: BTW personally I don&#x27;t like the idea of logging in via LinkedIn (for finding a security talent), it&#x27;s feels too intrusive, beside of the personal preference my experience showed me especially security industry don&#x27;t like SSO style things.