Plain English
Writing penetration test objectives that the report can answer
Penetration test objectives say why you are testing, not just where. A target list tells the firm which systems to look at. However, objectives tell it which questions to answer, so the report ends up useful to the people who asked for it.
- Authorisation before any test
- Plain-English guidance
- Written scope on every engagement
Why penetration test objectives matter
Two tests of the same systems can produce very different reports. One lists every issue found. The other answers a clear business question, such as whether customer data can be reached from the internet.
Because objectives decide depth and focus, they also affect the fee. So write them before asking for quotes.
Examples of penetration test objectives
Good objectives are short, specific and tied to a real concern. Each one should be answerable with a yes, a no or a clear explanation.
Also link each objective to whoever asked for the test. Then the report can speak directly to that reader.
| Concern | Objective in plain words |
|---|---|
| A customer review | Show that our main product was tested by an outside party |
| A new release | Find weaknesses in the new features before launch |
| An audit | Provide evidence of annual testing for the auditor |
| A recent scare | Confirm what else is reachable from the affected system |
| A merger | Understand the security of the systems we are taking on |
Penetration test objectives check
Tick what your objectives already do.
Your result appears here as you tick, so you can see what is still open.
Agreeing penetration test objectives
Draft them with the security lead, then share them with the sponsor. If the sponsor would ask a different question, change them now rather than after the report.
In addition, share them with the firm before it writes the scope. As a result, the proposal answers your real question.
What objectives do not change
Objectives never widen authorization. A test can only cover systems whose owners have signed, whatever the objective says. Laws such as the UK Computer Misuse Act 1990 make no exception for good reasons.
So if an objective needs a system outside the scope, get the owner's signature first.
Using penetration test objectives in the report
Ask the firm to answer each objective near the start of the report. Then readers see the conclusion before the detail.
Finally, review the objectives at the debrief. If one was not answered, the reason should be written down.
How we use them
We ask for your objectives with the brief and write them into the scope. Named senior practitioners do the work, and the owner signs authorization first.
Full engagements run from $35,000 to $120,000, while the floor is $25,000. Also, the bounded External Attack Surface Review starts at $4,500. Moreover, its fee is credited in full against a full engagement commissioned within ninety days. Every fee is agreed in writing before anyone starts. The method follows the Penetration Testing Execution Standard.
Penetration test objectives questions
How many penetration test objectives should we set?
Usually two to four. More than that tends to blur the focus.
Who writes penetration test objectives?
The security lead drafts them, and the sponsor agrees them.
Do objectives change the fee?
They can, because they decide depth and focus.
Can penetration test objectives widen the scope?
No. Only a signed authorization can do that.
Related guides
Send us your penetration test objectives
Tell us the questions the report must answer. We reply with a written scope and a fixed fee.
Ask about authorised testing