What to know before commissioning a penetration test: cost, scope, reports and choosing a provider.
What drives the price of a penetration test: scope size, test type, depth of manual work, black versus grey box, retesting, reporting needs and timing; one-time versus recurring costs and what to ask for in a quote, without invented price figures.
Turning a goal or compliance requirement into a scope: targets, environments, accounts and roles, exclusions, testing windows, rules of engagement and the information to share, using NIST SP 800-115 planning and PCI SSC scoping guidance.
What to put in a request for proposal for penetration testing: objectives, scope, methodology expectations, tester qualifications, report and retest requirements, data handling, insurance and the questions that separate manual testing from scan resale.
What a good report contains, from executive summary, scope, methodology and limitations to findings with severity reasoning, evidence and remediation advice, and how to read one; based on the PCI SSC report outline and ASVS reporting guidance.
How retests work: when to schedule them, what is retested, how retest reports document closed findings, why PCI DSS 11.4.4 requires repeating tests after fixes, and when long delays mean a new test is needed instead.
The three knowledge levels explained with PCI SSC definitions, the trade-off between realism and coverage, why grey and white box usually give more findings per day, and how NIST's overt and covert distinction differs.
How automated vulnerability scanning and assessment differ from manual penetration testing in purpose, method, frequency, duration and report, using PCI SSC's comparison, and when an organization needs one, the other or both.
What continuous or ongoing testing models offer compared with a point-in-time annual test, how they combine scanning with periodic manual testing after changes, and how to judge whether a continuous offering still includes real manual work.
How to evaluate a provider: methodology, sample reports, tester experience and certifications, CREST or similar accreditation, independence, safe testing practices, data handling and retest terms, using the qualification questions PCI SSC suggests.
Testing frequency set by standards and risk: annual and after significant change under PCI DSS and CIS Controls, risk-based under NIS2, every 3 years for DORA TLPT, and how release cadence and major changes should trigger extra tests.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.