Specialization: focus on specific industries (healthcare, financial services) or testing types (cloud, IoT, red team) - Accreditation: CREST, CHECK, or other relevant accreditations - Methodology: documented, repeatable, defensible testing approach - Reputation: track record of quality work and sati