A practical look at how pentesting vendors such as XBOW, OffSec, and Cobalt are being evaluated on exploitability, attack paths, reporting quality, and measurable risk reduction rather than vulnerability counts alone.