Penetration Testing Engagement Process

1. Discovery call#

We establish why you are testing, what matters, technical ownership and likely scope. No obligation to buy a broad security package you do not need.

2. Written scope and rules of engagement#

Targets, source IPs where relevant, test accounts, allowed methods, excluded actions, reporting contacts, dates and emergency stop conditions are agreed.

3. Assessment#

We map attack surfaces and evaluate high-risk controls using targeted tooling and manual validation. Material blockers and critical issues are escalated according to the agreed process.

4. Findings and walkthrough#

A report explains impact and reproduction. We can discuss prioritization and what a correct fix should enforce at the trust boundary.

5. Retest#

If part of the agreement, remediated findings are tested again with evidence. Any residual risk or inability to verify is recorded instead of silently marked resolved.

What determines effort?#

Number of roles and tenants, sensitive workflows, API surface, build stability, test account access, integrations and operational restrictions usually matter more than the number of visible pages.