Interesting idea, a couple of thoughts from a quick read through.<p>- I'd suggest that customer feedback may not necessarily the best way to guage security tester* competence. Many testers report by exception so if the customer gets a relatitvely clean report they may be happy with that, but if the report doesn't detail the testing completed, how do they know the tester just didn't miss things from the review? You could enforce a consistent reporting style with tests completed to address that, but I'd guess that some testing companies wouldn't appreciate being asked to re-tool their reporting process.<p>- The model seems to imply the customer scopes the review. In my experience for organisation with less experience of security testing, that's one of the hardest parts to get right. More experienced/larger companies would, I'd expect, be less likely to use this kind of service as they already have a panel process/procurement in place. If Stealth Worker are going to participate in the scoping proces it would need the right set of people to complete that task (not a massively common skillset in my experience as it needs a good combination of technical experience and business understanding)<p>- Will the marketplace validate vendor claims of competence/skillset, and if so how will they do that? This could be a good value add, but is expensive to do well (e.g. designing and running assessments for candidate companies to provide a level of assurance of skill in particular areas).<p>- It'll be challenging to create an international model for this, as the regulatory requirements are different per country, and whilst testing companies might currently have indemnity insurance in their local market, that may well not cover international situations.<p>- The site could use some fleshing out on the team side. Currently says "Stealth Worker is a team of CISOs, developers and lawyer" .... To me there's a large ommission there which is from that it implies you don't have any testers on staff?!? I'm sure that's not the case, so it'd be worth making sure that was in clear on the site.<p>*Pet peeve, I prefer the term security testing to pen testing. The term pen testing rarely describes what most organisations actually need and also what is delivered. Pen testing implies a black box adversarial review "emulates a malicious attacker". This is only really desirable for mature organisations who have a strong handle on all the basic (which is not, in my experience, the majority). Also truly emulating attackers is very difficult as they tend not to worry about breaking the law, unlike testing companies (you'd hope!)