There are thousands of firms who will happily run a vuln scan or webapp crawler and send you a crappy canned report. There are less who can really perform a comprehensive test and document the hell out of it.

I personally think pen testing is not very useful, except as a 3rd party check to tell you if you've done a reasonable job at protecting your software (and if you get a bad tester, you literally won't know!). We need more people in InfoSec who can explain how to build defensible software - finding holes is the easy part.