Plain English
How to write a penetration test brief
A penetration test brief is the short note you send a firm before it quotes. It is not a contract, and it does not need technical detail. However, a clear brief is the fastest way to a written scope and a fixed fee.
- Authorisation before any test
- Plain-English guidance
- Written scope on every engagement
What a penetration test brief is for
The firm needs to understand your reason, your systems and your timing. With those three things, it can draft a scope and price it. Without them, it can only guess.
In addition, the same brief sent to several firms makes their answers comparable. So it doubles as the start of your procurement record.
What to include in a penetration test brief
Keep it to one page. Use plain words, and say where you are unsure. A good firm will ask follow-up questions in writing.
Also mention any deadline and who is asking for the test. Because the reader of the report matters, the firm can write for them.
| Section | What to write |
|---|---|
| Reason | Who asked for the test, and why |
| Systems | A short list, with rough sizes |
| Timing | Preferred window and any deadline |
| Constraints | Fragile systems or busy periods |
| Contacts | Who will own the project |
Penetration test brief checklist
Tick what your draft already covers.
Your result appears here as you tick, so you can see what is still open.
What to leave out of a penetration test brief
Do not send passwords, internal diagrams or known weaknesses at this stage. Those belong in the scope and rules, after a confidentiality agreement is signed.
Similarly, do not try to design the test. Describe your concern, and let the firm propose the approach.
From penetration test brief to scope
The firm reads the brief and replies with questions or a draft scope. Then you agree the scope, the exclusions and the fee in writing.
Finally, each system owner signs authorization. Only then does testing start, as laws such as the US Computer Fraud and Abuse Act guidance require.
Common gaps in a brief
The most common gap is a missing reason. Another is a system list that mixes systems you own with systems a supplier runs. Both slow the reply.
So check two things before sending. Is the reason clear, and do you own everything on the list?
Sending one to us
Send your brief through the form on our home page. Named senior practitioners read it, and we reply in writing with a scope and a fixed fee.
Full engagements run from $35,000 to $120,000, while the floor is $25,000. Also, the bounded External Attack Surface Review starts at $4,500. Moreover, its fee is credited in full against a full engagement commissioned within ninety days. Every fee is agreed in writing before anyone starts. The method follows the Penetration Testing Execution Standard.
Penetration test brief questions
How long should a penetration test brief be?
One page is usually enough.
Should a penetration test brief include technical detail?
No. Keep that for the scope, after an NDA is signed.
Can we send the same penetration test brief to several firms?
Yes. It makes the answers easier to compare.
What comes after the brief?
A written scope, a fixed fee, then signed authorization.
Related guides
Send us your penetration test brief
Use the form on our home page. We reply in writing with a scope and a fixed fee, and nothing starts before the owner signs.
Ask about authorised testing