Inquire about their experience in penetration testing projects, the methodologies they use, and their approach to identifying and mitigating security risks. Ask about their certifications, such as Certified Ethical Hacker (CEH), and how they stay updated with evolving cybersecurity threats.