From personal experience having worked with multiple "enterprise-grade" pentest vendors (including NCC), I think the entire pentest industry is overdue for a big shake-up.
Well it's going into the trash compactor along with all the other jobs that are highly vulnerable to automation with LLMs, but at the same time LLMs have spawned a panic buying spree of AI pentesting contracts. It's going to be a wild ride before the dust settles.
yeah it's impossible to imagine the next year being anything other than a wild ride
yeh running some automatic scripts against public urls to check if https is enabled and scanning if there are public s3 buckets is barely any better than a security linter.
There are some teams that are better than this, but they are rare.
The press release speaks of "a rigorous source-code security assessment by NCC Group." That suggests more than a bit of url scanning. Somebody is lying, that much is certain.
Where does one go for a trustworthy pentest or security review? Especially, where do smaller companies perhaps go that aren't at the multi-million level.
I can recommend https://includesecurity.com/ , they're very reasonably priced and will probably catch any glaring issues you have, but they probably won't catch any subtle issues on their entry-level pricing.