A customer asked for a pentest
Use the original request to determine the expected activity, scope, evidence, and timing.
Customer-required testingPenetration testing
Your pentest starts with the requirement.
Trespass Security provides penetration testing for customer and assurance requirements. We define the authorized scope, investigate findings, and deliver a report your team and customer can use.
Why companies contact us
Start with what caused the request.
Review the requirement
First, confirm what the requester actually wants.
We start with the request, the systems it concerns, and the report the requester expects.
For web applications, testing can cover accounts, user roles, tenant boundaries, workflows, and supporting APIs.
Review web application testing coverage- Identify the requesting party and the exact language used.
- Confirm the systems, environments, and business workflows named or implied.
- Distinguish penetration testing from vulnerability scanning and PCI-specific activities.
- Confirm who will read the report and when they need it.
- Identify system ownership, third-party limits, safety restrictions, and access needs.
The process
Know what happens before, during, and after testing.
The scope and Rules of Engagement state what can be tested and how. If access, systems, or restrictions change, we pause to review what can proceed.
Read the full processReview the requirement
Confirm who asked, the exact wording, why the test is needed, the deadline, and what they expect to receive.
Define the engagement
Document the objective, authorized systems, environments, user roles, exclusions, responsibilities, limitations, and deliverables.
Prepare and authorize
Confirm ownership or permission, access, contacts, restrictions, stop conditions, agreements, and Rules of Engagement.
Perform the assessment
Exercise the authorized attack surface, investigate potential findings, and escalate material issues through the agreed channel.
Report and follow through
Deliver findings with evidence and remediation direction, hold a live review, and reassess remediated findings within the approved retest window.
During testing
We test only what has been authorized.
- Defined coverage
Testing follows the approved systems, environments, roles, techniques, and exclusions.
- Findings are investigated
Potential issues are checked for real behavior, reachability, impact, and relevant attack paths.
- Named contacts
Questions and material issues follow the agreed contacts, escalation paths, and stop conditions.
- Limits are documented
Access problems, unavailable systems, changes, and other limits are recorded in the report.
Report and retest
A report for your team and your customer.
Sharing depends on the engagement terms, the sensitivity of technical detail, and the recipient’s requirements. An executive summary and a full technical report may serve different audiences.
The requesting party makes the final decision about whether the resulting evidence meets its needs.
See a sample report- Executive summary
Why the test occurred, what was tested, and what leadership should understand.
- Scope and methods
Authorized systems, work performed, and anything that limited the test.
- Findings and evidence
Observed behavior, risk, supporting evidence where appropriate, and remediation guidance.
- Retest results
What was checked again after remediation and what the retest found.
Next step
Tell us what your customer needs.
Tell us who asked, what they need, which systems may be involved, and when they need an answer. We’ll make the next scoping questions clear.