A customer, prospect, or partner asked
Review the original wording, intended evidence, systems, and deadline before deciding what to purchase.
Review the customer requestYour situation
Why were you asked for a pentest?
Choose the situation closest to yours. We’ll use the original request to separate what is known, what needs clarification, and which testing or evidence is actually relevant.
Choose a starting point
What caused the request?
A customer request, SOC 2 process, PCI DSS requirement, or first test can change what you need to confirm before testing.
An assurance process raised the need
Confirm whether the expectation comes from an auditor, customer, adviser, control, risk process, or internal policy.
Review the assurance needA PCI DSS requirement applies
Separate penetration-testing activities from Approved Scanning Vendor vulnerability scanning and clarify the applicable environment.
Review PCI DSS testingThis is your first penetration test
Learn what to collect, what the provider should help define, and what your team remains responsible for.
Plan your first testYour application needs to be assessed
Understand application coverage, roles, APIs, workflows, environments, preparation, and exclusions.
Scope the applicationYou are not sure which test was requested
Compare vulnerability scanning with penetration testing before deciding what the requesting party expects.
Compare the twoWhat if more than one situation applies?
That is normal. A customer request may be connected to SOC 2, involve a web application, and also be your company’s first penetration test. Start with the party or process that created the requirement, then use scoping to define the technical work.
If the wording is vague, send the exact language rather than guessing which test it means.
Start with four questions
These details tell us where to begin.
Who asked?
A customer, procurement team, auditor, adviser, assessor, internal policy owner, or another party.
What did they ask for?
A penetration test, scan, current report, proof of testing, remediation status, or a questionnaire response.
Which systems are involved?
A web application, API, network, cardholder data environment, segmentation control, or an unclear set of systems.
Is there a deadline or restriction?
Share any deadline, environment restriction, third-party dependency, report requirement, or testing condition.
Next step
Not sure which path applies? Send the original request.
A brief non-sensitive summary is enough. Trespass will identify the questions that must be resolved before an engagement can be defined.