Plain English
Your first penetration test, step by step
A first penetration test can feel like buying something you cannot see. However, the process is mostly decisions and documents. So this guide walks through each one in order, without jargon.
- Authorisation before any test
- Plain-English guidance
- Written scope on every engagement
Why organizations order a first penetration test
Usually someone asks. A large customer, an investor or an auditor wants evidence that your systems were tested by an outside party. Sometimes the trigger is a big change, such as a new product or a cloud move.
Either way, the reason shapes the work. So write it down first, in one sentence, because every later decision depends on it.
The decisions before a first penetration test
First, choose what will be tested. Then decide who inside your organization owns the project and who can sign for each system. Finally, pick a date window that avoids your busiest weeks.
Also agree who receives the report. Because it lists weaknesses, it should go to a short, named list.
| Decision | Who usually makes it |
|---|---|
| Why we are testing | The executive sponsor |
| What is tested | The security lead and system owners |
| Who signs authorization | The owner of each system |
| When it happens | The project owner |
| Who reads the report | The sponsor and security lead |
First penetration test checklist
Tick what you have already settled.
Your result appears here as you tick, so you can see what is still open.
Documents for a first penetration test
Expect three. The scope lists what is in and out. Next, the authorization is signed by the system owner, and it is what makes the work legal under laws such as the US Computer Fraud and Abuse Act guidance. Finally, the rules of engagement set hours, contacts and limits.
In addition, most firms sign a confidentiality agreement. Then the commercial terms, such as the fee, sit in an order or contract.
How long it takes
Paperwork often takes longer than testing. Approvals inside your own organization can take one to three weeks. Then the testing window and the report follow.
So start early if you have a deadline. A rushed scope is the most common reason a first report disappoints.
What you receive at the end
You receive a report with a summary, findings and fixes. Then a debrief walks your team through it. Later, a retest confirms the fixes worked.
Because the report is the evidence, keep it with the signed scope. Together they show what was tested and when.
If you want us to run it
Named senior practitioners do the work, with no junior bench. The owner signs authorization before any testing, and the method follows the Penetration Testing Execution Standard.
Full engagements run from $35,000 to $120,000, while the floor is $25,000. Also, the bounded External Attack Surface Review starts at $4,500. Moreover, its fee is credited in full against a full engagement commissioned within ninety days. Every fee is agreed in writing before anyone starts.
First penetration test questions
How do I start a first penetration test?
Write down why you are testing, then list the systems that matter.
Is a first penetration test risky?
The rules of engagement set limits and contacts, so risk is managed in writing.
How long does it take?
Often several weeks end to end, mostly because of approvals.
What does a first penetration test cost?
It depends on scope. The fee is fixed in writing before anyone starts.
Related guides
Plan your first penetration test
Tell us why you are testing and what matters most. We reply with a written scope and a fixed fee, and nothing starts before the owner signs.
Ask about authorised testing