To check whether a New Zealand provider is CREST accredited, look up the exact company on the CREST Marketplace. Do not rely on a logo or a line on a website. CREST accredits companies. It also runs exams for individual testers, and the two are not the same thing. This guide gives you a five-minute check, explains what each CREST badge means, and shows what to do when a claim does not match the listing.
What does CREST actually accredit?
CREST accredits organisations against published standards for specific services, such as penetration testing. Its Marketplace lists about 550 companies. CREST says accreditation covers the policies, processes and competencies a company has in place to deliver the service, and members are bound by a Code of Conduct and a complaints process.
One point surprises many buyers. CREST's own standards page says there is no mandatory requirement for individuals to be CREST qualified for a company to achieve accreditation. CREST assesses people on their skills, experience and any qualifications they hold. So "CREST-accredited company" and "CREST-certified tester" are different claims, and a firm can make one without the other. Ask which people will test your systems.
Why does this matter? A buyer who hears "our team is CREST certified" may assume the company was assessed. A buyer who hears "we are CREST accredited" may assume every tester holds an exam. Neither follows automatically. The clean test is the Marketplace listing for the company, plus a named list of testers.
The five-minute check
Here is the check, step by step.
Search by company name. Open the CREST Marketplace and search for the legal company name in your contract. A free account unlocks more filters.
Read the Key Info. It shows years of membership, headquarters country and company size. Make sure it matches the company you are contracting with.
Check Accreditations and Specialisms. If you are buying a penetration test, look for Penetration Testing. A different accreditation, such as a security operations centre, does not cover it.
Read Company Certifications. These sit apart from accreditations. Check what each one means before you rely on it.
Ask about people and complaints. Ask who will do the work, what individual credentials they hold, and for the company's complaint handling process. CREST's own complaints process expects members to give it to each client.
What does each CREST badge mean?
Penetration Testing
An independent assessment that the company can deliver penetration tests to CREST's standard.
Security Testing of AI
A supplement for testing the security of AI systems, such as chatbots and agents. Applications opened in August 2026, and CREST named the first four companies on 3 November. Our explainer on the accreditation covers it in detail.
AI-Enabled Penetration Testing
An annex to the penetration testing standard. It is about how a provider uses AI in its own testing, not about testing your AI. CREST named the first ten companies on 3 September.
CREST AI Charter
A public commitment to CREST's nine AI principles. It is not a service accreditation.
Individual exams
CREST certifications for people, such as CPSA, CRT and CCT. Ask for names, not just a company badge.
What are the red flags?
- No Marketplace profile for the company that will sign your contract.
- "CREST certified company" wording with no listed accreditation.
- A parent brand on the website but a different legal entity on the listing.
- A badge on the website that the profile does not show.
- A page aimed at New Zealand buyers that mentions CREST but gives no company name you can check.
Put it in writing. Name the exact legal entity and the accreditation you are relying on in your statement of work, and ask to be told if either changes. That keeps the claim tied to the company that does the work.
Is CREST required in New Zealand?
We know of no New Zealand law that requires it, so be wary of anyone who says there is one. Some customers, auditors and buyers do ask for it, so check what yours require. Treat accreditation as a baseline, not a guarantee. Our guide to choosing a provider covers the wider checklist, and our piece on what CREST certification means in practice explains why buyers look for it.
What should you ask once you have verified?
Ask for a sample report, and read it using our guide to how to read and act on a penetration testing report. Ask who will test and what they hold. Ask whether retesting is included and for how long. If AI is part of the service, ask how it is used and how your data is protected. CREST's AI principles ask signatories to explain whether customer data may train models or leave agreed jurisdictions.
Capture The Bug's own profile lists Penetration Testing accreditation, a Security Testing of AI specialism and the CREST AI Charter. Check it yourself, and put these same questions to us.
Frequently Asked Questions
How do I check if a penetration testing company is CREST accredited?
Search for the exact legal company name on the CREST Marketplace and open its profile. Check the accreditations and specialisms for Penetration Testing, read the company certifications separately, and confirm the listed company matches your contract. Do not rely on a logo or website wording alone.
What is the difference between CREST accredited and CREST certified?
CREST accredits companies against published standards for services such as penetration testing. CREST also runs certification exams for individual testers. They are separate claims. A firm can say one without the other, so ask which named people will test your systems and what they hold.
Must a CREST-accredited company employ CREST-certified testers?
No. CREST's accreditation standards page says there is no mandatory requirement for individuals to be CREST qualified for a company to be accredited. Individuals are assessed on skills, experience and any qualifications they hold. Ask a provider to name its testers and credentials.
Is CREST accreditation required in New Zealand?
We know of no New Zealand law that requires it. Some customers, auditors and buyers ask for it, so check what yours require. Treat accreditation as a baseline, then compare scope, reporting, retesting and sample reports.
Which CREST badge should I look for if I am testing an AI feature?
Look for the Security Testing of AI specialism, which covers testing the security of AI systems. AI-Enabled Penetration Testing is different: it covers how a provider uses AI in its own testing. The CREST AI Charter is a public commitment, not a service accreditation.
