ESSENTIAL GUIDANCE · QUESTIONS ANSWERED · 3 min read
Part of Validate insights →Security testing questions on scope delivery and follow-up
Answers to common questions about authorisation, testing models, prices, supplier boundaries, reports and remediation.
Answers to common questions about authorisation, testing models, prices, supplier boundaries, reports and remediation.
Need an acronym translated?Open the cyber glossary →What should we prepare before asking for a proposal
Describe the service, the important assurance question, target systems, environments, user roles and relevant suppliers. Include constraints such as operating windows, fragile systems or a deadline. The scoping workbook provides a practical starting point. It helps define the work but does not itself authorise testing; the required written permission and rules must be agreed separately.
How do scanning AI-enabled and human-led testing differ
Scanning can provide repeatable observations across a defined technical boundary. Penetration testing investigates selected risk questions within an authorised scope. Pentesys offers AI-enabled, Combined and distinct CREST-accredited human-led routes. Keep the selected model explicit in the proposal. Specialist human investigation is separately scoped and can be delivered through the Pentesys Portal where agreed.
Can testing be scheduled or triggered by a change
AI-enabled and human testing can be scheduled when an engagement is defined in the Portal. Portal automations can define the permitted response to a detected change. Agree targets, exclusions, methods, operating limits, escalation contacts and stop conditions. Monitoring a new asset does not automatically authorise active testing of it, particularly where ownership or supplier permission is uncertain.
Where can we see current prices and inclusions
Use the current pricing page for indicative figures and request a proposal for the actual scope. Roles, application workflows, interfaces, environments, access, depth and delivery model can change the required work. Compare reporting, debrief and retest arrangements as well as the headline figure. Do not assume a recurring programme includes unlimited testing or every form of specialist investigation.
What happens after testing
Translate findings into owned actions, prioritise important risks and retain appropriate follow-up evidence. Agree the retest scope so a checked correction is distinguishable from an unverified status change. The Portal can connect scope, findings, evidence, remediation ownership, retesting and reporting. Testing gives bounded assurance about what was assessed; useful follow-through keeps that evidence connected to the current service.
This guide covers the essentials. Continue into our technical analysis for a firmer position, practical implications and recommended action.
Read “Modern penetration testing should create decisions, not just findings” →
