When is this useful?
Before a release, after a significant change or to examine a specific risk, you need to know whether your defences withstand a defined scenario. Penetration testing examines an agreed scope. It should produce findings that decision-makers can understand and technical teams can address.
Reporting to plan
- A summary of observed risks within the tested scope
- Documented technical findings with context
- Recommendations and arrangements for an optional retest
Scope, timeline and deliverables are agreed before work begins.
Frequently asked questions
Does a test guarantee there are no vulnerabilities?
No. It reports the results of a bounded engagement with its assumptions and constraints. Finding no issue does not prove there is no risk.
Can production systems be tested?
This is decided during scoping. Possible impacts, testing windows and stop conditions must be reviewed with system owners.