Pen-Test Scope Builder — Build a Real Scope in Minutes

Agreed in writing, before anyone touches a thing. Tick what applies and add the specifics. Full explanation ↓

Timing & blackout windowsTesting days and hours, and the periods when testing stops cold (peak sales, month-end, a launch).

Forbidden techniquesWhat’s off the table: denial-of-service (DoS)Flooding a system with so much traffic that real users can’t reach it. We never do this in a test unless you specifically ask., destructive payloads, social engineeringTargeting your people rather than your machines: phishing emails, phone pretexts, tailgating through a door. unless asked for.

Data handlingIf we reach real records: prove access, capture the minimum evidence, stop. Then how it’s stored and destroyed.

Escalation of criticalsThe threshold for a call within the hour if something severe turns up, and who to call.

Deconfliction contactsOne named person each side, reachable by phone during testing, so your SOCSecurity Operations Centre: the team watching your security alerts. can confirm activity is the test, not a real attack.

Build a real test scope. Yours in two minutes.

Build a scope you can actually quote against.

Scope in hand? Let’s price the test.