Pen test vendor quality varies enormously inside any price band, so your leverage is the scope and the deliverable spec, not the shortlist. How to tell scanning, automated pen testing, manual testing and red teaming apart in a proposal, name a methodology like the OWASP WSTG or NIST SP 800-115, buy tester days instead of IP addresses, read certifications honestly, and specify the report before you ask for a price.
What a Public Hospital Must Settle Before Deploying AI Scribes
Ambient AI scribes in a public health service are a record-keeping, privacy and industrial decision, not a software purchase. What the TGA, OAIC and Ahpra positions actually say, what the published evidence does and does not show, and a staged pilot you can defend.