Plain English
Penetration test exclusions, and how to write them
Penetration test exclusions are the systems, times and activities that are left out on purpose. They are as important as the scope itself. Because anything not listed can cause confusion, the out list deserves as much care as the in list.
- Authorisation before any test
- Plain-English guidance
- Written scope on every engagement
Why penetration test exclusions matter
An exclusion protects something. It might be a fragile system, a supplier's platform or a period when the business cannot accept any risk. So each one needs a reason.
In addition, exclusions shape how the report is read. A reader who does not know what was left out may assume more was tested than really was.
Common penetration test exclusions
Some exclusions appear in almost every scope. Others depend on the systems and the business calendar.
Write each one in plain words, with its reason. Then nobody has to guess later.
| Exclusion | Usual reason |
|---|---|
| Systems owned by others | No authorization from their owner |
| Fragile or legacy systems | Risk of disruption |
| Busy business periods | No tolerance for any delay |
| Certain activities | Agreed limits in the rules of engagement |
| Live customer data | Kept out unless strictly needed |
Penetration test exclusions check
Tick what your out list already includes.
Your result appears here as you tick, so you can see what is still open.
Penetration test exclusions and the law
A system without its owner's signed authorization must be excluded, whatever its importance. Laws such as the US Computer Fraud and Abuse Act guidance turn on that authorization.
So if a key system is hosted by someone else, either obtain their consent or list it as excluded. There is no middle ground.
Writing penetration test exclusions well
Name each excluded item precisely. A vague exclusion, such as all old systems, is hard to apply. Then add the reason and who decided it.
Also set a review date for each one. Because systems change, a sensible exclusion this year may not be needed next year.
How exclusions appear in the report
A good report repeats the exclusions near the start. Then auditors and customers can see the limits of the work at a glance.
Similarly, the report should note anything that could not be tested during the window. As a result, the evidence is honest about its own edges.
How we handle them
We list exclusions in the written scope, with reasons, and repeat them in the report. The owner signs authorization before any testing.
Full engagements run from $35,000 to $120,000, while the floor is $25,000. Also, the bounded External Attack Surface Review starts at $4,500. Moreover, its fee is credited in full against a full engagement commissioned within ninety days. Every fee is agreed in writing before anyone starts. The method follows the Penetration Testing Execution Standard.
Penetration test exclusions questions
Are penetration test exclusions normal?
Yes. Almost every scope lists some systems or periods that are left out.
Must penetration test exclusions have a reason?
They should, so readers understand the limits of the work.
Can an excluded system be added later?
Yes, once its owner signs authorization.
Do penetration test exclusions appear in the report?
They should, near the start, so readers see the limits.
Related guides
Write your penetration test exclusions with us
Send your systems list and any concerns. We reply with a written scope, its exclusions and a fixed fee.
Ask about authorised testing