How testing works
From the request to the report.
We clarify what your customer needs, define the authorized scope, and carry the work through testing, reporting, and retesting.
The complete sequence
Eight steps. Clear responsibilities.
The details vary by test, but no testing begins until the required documents and authorization are complete.
Send the requirement
Provide a non-sensitive summary of who asked, the language they used, the systems that may be involved, and any deadline.
Clarify the objective
We identify what the requesting party appears to need, what evidence they expect, and which questions must be resolved.
Define the engagement
Together we document scope, responsibilities, exclusions, prerequisites, proposed dates, communication paths, and deliverables.
Complete authorization
Agreements, written authorization, Rules of Engagement, stop conditions, and appropriate system permissions must be complete before testing.
Prepare access
Your team readies accounts, access paths, allowlisting, monitoring, backups, contacts, approvals, and any agreed environment controls.
Perform the assessment
Trespass performs only the authorized work, investigates findings in context, and follows the agreed communication and escalation paths.
Deliver and review the report
You receive the report and a live review covering scope, limitations, findings, evidence, risk, and remediation direction.
Remediate and retest
Your team addresses findings and submits them for one consolidated reassessment within the approved retest window.
Before testing
Know what is included. Know what to prepare.
The proposed scope lists the goal, systems, coverage, exclusions, responsibilities, preparation, contacts, limitations, dates, report, and retest.
If the original request is still unclear, we say so and identify the question that remains.
See a statement of workWhat we clarify during scoping
Why the test is needed
- Who requested the test and why
- The original request language
- The deadline
- Who will receive the report
- Known contract or assurance requirements
What may be tested
- Likely systems and environments
- Application modules and APIs
- User roles and access paths
- Third-party systems
- Known production restrictions
What your team prepares before testing
What your team will provide or confirm
The exact list depends on the authorized test.
- Confirm ownership or obtain permission from the appropriate system owner
- Provide accurate system and business information
- Prepare agreed accounts, roles, access paths, and environment controls
- Name primary and escalation contacts who can respond during testing
- Disclose relevant restrictions, sensitive workflows, and third-party dependencies
- Maintain appropriate backups, monitoring, and internal change awareness
- Review findings, coordinate remediation, and submit eligible items for retesting
If something changes
Changes are reviewed before work continues.
Changes to systems, access, or scope can affect what we are allowed to test and what the report can say.
- The scope expands
New systems or testing goals must be reviewed and authorized before they are added.
- Access is incomplete
We document how missing access affects coverage and timing. We do not quietly replace the agreed test with different work.
- The system changes
We decide whether testing should pause, be repeated, or be rescheduled.
- A stop condition occurs
Testing stops and the agreed contacts are notified before work resumes.
After testing
We review the findings and retest eligible fixes.
The report states what we were allowed to test, what we did, what we found, and what limited the work.
- Trespass conducts a live findings review and answers remediation questions.
- Your team decides how to fix the findings and completes the work.
- Eligible fixes can be submitted together for the included consolidated retest within the approved window.
- The retest results state what was checked again and what we observed.
- The requesting party decides whether it accepts the final evidence.
Next step
Start with the request you received.
Tell us who asked, what they need, which systems may be involved, and when they need an answer. We’ll make the next scoping questions clear.