How to choose a cybersecurity provider for mid-sized companies?

Choose a cybersecurity provider on evidence, not promises: first define what you need to protect, demand certifications with a verifiable scope, ask for references and concrete deliverables, review the contract and responsibilities, and compare using a weighted criteria matrix. A bounded pilot lowers the risk before you commit long term.

Before looking at providers: define what you need

Most bad hires start with a vague brief. Before asking for proposals, answer in writing:

1. Which assets and processes do you want to protect? (customer data, production, exposed applications, identities).
2. Which obligations do you have? Sector regulation, customer requirements or tender conditions. The European Commission explains, for example, that NIS2 requires medium-sized and large entities in the sectors it covers to take appropriate cybersecurity risk-management measures [1]. If you do not know what applies to you, start with GRC consulting.
3. Which outcome do you expect? Reduce a specific risk, pass an audit, get continuous monitoring.
4. What internal capacity do you have? Who will receive the reports and decide.

Which type of provider you need

At Hodeitek we offer pentesting and Red Team, managed SOC, GRC consulting, training and awareness and AI security consulting.

Eight criteria to compare

1. Certifications and scope

A certification is only worth its scope. Ask for the certificate, the exact scope and, for ISO/IEC 27001, the statement of applicability. For cloud providers, the Cloud Security Alliance's public STAR registry lets you check the assurance level they have declared [2], and AICPA's SOC reports provide information to assess the risks of outsourcing a service [3]. As an example of transparency, Hodeitek publishes its certificates (ISO/IEC 27001 and ENS Medium category) and their scope on its company page.

2. Methodology and reference standards

A serious provider explains which frameworks it works with. In a SOC, for example, MITRE ATT&CK to describe adversary techniques [4] and NIST SP 800-61 for incident response [5]. In an application pentest, OWASP's WSTG testing guide [6] or the ASVS requirements [7]. If it cannot say which reference it follows, that is a bad sign.

3. Team, coverage and response times

Ask who will do the work (not just who sells it), with what experience and personal certifications, and what hours of coverage it has. A service level agreement should set reaction and resolution times by severity, and how they are measured.

4. Security of its own supply chain

Your provider has providers too. NIST offers guidance to identify, assess and mitigate cybersecurity supply chain risks at every level of the organisation [8], and the UK NCSC notes that most organisations rely on suppliers to deliver products, systems and services [9]. Ask which subcontractors are involved, what data reaches them and what component inventory it can share with you (for example, an SBOM [10]).

5. Deliverables and transparency

Ask for a sample report with anonymised data: structure, level of detail, prioritisation and recommendations. A good report lets you act without calling its author. Be wary of results that are only shown in a presentation.

6. Contract and responsibilities

Review with legal advice: scope and exclusions, confidentiality, data processing, liability and indemnities, subcontracting, incident notification and deadlines, audit rights and exit terms (reversibility and return of data).

7. Data, location and use of AI

Clarify where your data is stored and processed, who has access and whether it is used to train models. If the provider uses AI, ask it to explain which decisions it takes and which a person reviews. We discuss this in what an agentic SOC is.

8. Pricing model and references

Ask for a fixed price or a clear model, and what is and is not included. Request references you can contact, from companies of comparable size and sector. You can see the case studies Hodeitek has published.

Weighted evaluation matrix (illustrative example)

Score each criterion from 1 to 5 and multiply by its weight. The weights and scores in the table are illustrative; adjust them to your case.

The downloadable checklist includes this matrix blank, questions for each criterion and a pilot guide.

Red flags

• "We guarantee you will never be attacked." Nobody can guarantee that.
• They will not put the scope in writing or will not show a sample report.
• Certifications without a verifiable scope, or that do not cover the service they offer.
• They ask for broad, permanent access without justifying it.
• They cannot name the people who will do the work.
• Opaque pricing or contract surprises (subcontracting, disproportionate liability limits).
• Pressure to sign quickly or without a pilot.

Pilot, measurement and exit

Before a long commitment, propose a bounded pilot (one scope, one timeframe and success criteria agreed in writing). Define metrics that matter to you (actionable findings, reaction time, report quality), and negotiate from the start how you will leave: data delivery formats, return and deletion deadlines.

If what you are evaluating is a TPRM platform

If what you need is a platform to manage your own suppliers, the evaluation has criteria of its own (framework coverage, evidence, integrations, scalability). We have a specific guide: How to Choose a TPRM Platform: Criteria for 2026. The question of how to evaluate TPRM platforms for your sector is covered in the HodeiShield blog, our third-party risk management and compliance platform, where you can also see its third-party risk solution. And on our own site, see our third-party and supply chain risk management solution.

Frequently asked questions

How to choose a cybersecurity provider for mid-sized companies?

First define what you need and compare between three and five providers; more multiplies the work without improving the decision. What matters is that all of them answer the same scope and the same questions, and validate your choice with a scoped pilot.

Is it enough for the provider to hold ISO 27001?

No. The certification attests to a management system with a specific scope; check that the scope covers the service you are buying, and complement it with references, methodology and contract.

What is the difference between a pentest and a managed SOC?

A pentest is a one-off controlled attack to find weaknesses; a managed SOC is continuous monitoring and response. They complement each other.

Is it better to use a single provider for everything?

It depends. A single provider simplifies management but concentrates risk; one per specialty gives independence (for example, the one who assesses is not the one who implements). Decide according to your size and internal capacity.

How long should a pilot last?

There is no universal duration: long enough to assess deliverables and communication with real cases; the tighter the scope, the less time is needed.

Next step

Download the checklist for choosing a cybersecurity provider or tell us your case and we will help you define the scope.

Sources

1. NIS2 Directive: securing network and information systems. European Commission. https://digital-strategy.ec.europa.eu/en/policies/nis2-directive
2. STAR Registry. Cloud Security Alliance. https://cloudsecurityalliance.org/star
3. SOC suite of services. AICPA & CIMA. https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2
4. MITRE ATT&CK. MITRE. https://attack.mitre.org/
5. Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (SP 800-61 Rev. 3). NIST, 2025-04-03. https://csrc.nist.gov/pubs/sp/800/61/r3/final
6. Web Security Testing Guide. OWASP. https://owasp.org/www-project-web-security-testing-guide/
7. Application Security Verification Standard (ASVS) 5.0. OWASP, 2025-05-30. https://asvs.owasp.org/
8. Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (SP 800-161 Rev. 1 Upd. 1). NIST. https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final
9. Supply chain security guidance. UK NCSC. https://www.ncsc.gov.uk/collection/supply-chain-security
10. Software Bill of Materials (SBOM). CISA. https://www.cisa.gov/sbom