Good preparation keeps testing days in testing rather than in waiting; it is the cheapest saving on a penetration test. This post lists what to decide before the scoping call, what to deliver before the start, and what to expect during and after the test, with a checklist at the end.
Before the scoping call
Five answers shorten the scoping call. Start with the goal, because a compliance requirement, a coming release and a first look at an untested application each lead to a different scope. Then list the systems and the user roles in them, since each role is tested in its own right. Say which environments exist and how close the staging copy is to production. Give the weeks in which testing may take place and the hours in which it may not. And name what must stay untouched, such as a payment gateway or a system in an audit period. These answers set the number of testing days, and the days set the price; the cost post shows how.
What to deliver three business days before the start
Materials are due three business days before the planned start date. Time lost because they arrive late is billed, so the list below deserves a reminder in the calendar.
Working test accounts per role come first. A test of an application with three roles and one account covers one role. Each account should be able to complete a normal workflow, and where login depends on a code sent by e-mail or text message, the tester needs a mailbox or a number that can be read.
Documentation comes second: an API specification, an architecture drawing, or a list of hosts and addresses. For a white-box test, add the source code or read access to the repository.
Then the network side. Where a firewall or a web application firewall would block the testers, allowlist their source addresses before the start; otherwise the first testing day is spent on the firewall instead of on the application. Name one contact person who can answer questions the same day, and agree the escalation path for critical findings, which is documented in the statement of work.
A test account that works on the first morning buys a full testing day; one that works on the second afternoon costs one.
Which environment
Offer a non-production copy with realistic data where one exists. It removes the risk to customers, lets the tester go further, and keeps the production change freeze intact. Production is tested only where no copy exists or where the production configuration is the point; in that case the statement of work names the test windows, the operations that are excluded, and the escalation contacts.
Who inside your organisation should know
Two groups need a decision. IT and the security operations centre (SOC) are informed when the goal is to find vulnerabilities; every hour they spend blocking the tester is an hour not spent on that goal. They are left uninformed only when the goal is to test detection, which is closer to red teaming than to a penetration test. The hosting provider is notified in both cases, because a provider that sees an attack may suspend the server.
During the test
Findings appear in the Pentrox Portal as they are confirmed, so remediation can start while testing continues. Critical findings are reported immediately through the channel agreed at kickoff. Keep the contact person reachable during testing hours, keep the environment and the accounts up, and treat a scope change as a decision; it happens only with written approval, and it changes the number of days.
After the test
The report follows within five business days after testing. A findings meeting walks through it with the people who will do the remediation. Fixes are then retested within 90 days of the report, and that retest is included in the assessment.
The checklist
| Item | Who | When |
|---|---|---|
| Goal, scope, roles and environments decided | Product owner or IT manager | Before the scoping call |
| Test window and excluded operations agreed | IT manager | Scoping call |
| Statement of work signed | Both parties | Before planning |
| Test accounts per role created and tried | Application team | Three business days before the start |
| Documentation, API specification, source code delivered | Application team | Three business days before the start |
| Tester source addresses allowlisted | Network or hosting team | Three business days before the start |
| Contact person and escalation path named | IT manager | Kickoff |
| IT, SOC and hosting provider informed | IT manager | Before the start |
| Contact person reachable, environment up | Application team | During testing |
| Findings meeting planned | IT manager | Within five business days after testing |
| Remediation done and retest requested | Application team | Within 90 days of the report |
Preparation is the part of a penetration test that you control; the scoping call covers the rest, and it can be planned through the contact page.
