Pen test vendor quality varies enormously inside any price band, so your leverage is the scope and the deliverable spec, not the shortlist. How to tell scanning, automated pen testing, manual testing and red teaming apart in a proposal, name a methodology like the OWASP WSTG or NIST SP 800-115, buy tester days instead of IP addresses, read certifications honestly, and specify the report before you ask for a price.