Plain English
Penetration testing terminology, explained for buyers
Penetration testing terminology can make a simple purchase sound complicated. However, a buyer needs only a short list of words. So here they are, grouped by the stage where you will meet them.
- Authorisation before any test
- Plain-English guidance
- Written scope on every engagement
Why penetration testing terminology matters
Proposals, contracts and reports all use the same few terms. If one word means different things to you and the firm, the scope can drift. Therefore it helps to agree the meaning early.
Also, auditors and customers read these terms in your report. So knowing them helps you answer their questions.
Words you meet before the test
These words appear in proposals and contracts. Most of them describe documents you will sign or approve.
Read each one with a simple question in mind. Who signs it, and when?
| Term | Plain meaning |
|---|---|
| Scope | The written list of what is tested and what is not |
| Authorization | The owner's signed permission to test |
| Rules of engagement | Hours, limits, contacts and pause rules |
| Black, grey or white box | How much the testers are told in advance |
| Testing window | The agreed dates and times for the work |
Penetration testing terminology quick check
Tick the terms you could explain to a colleague.
Your result appears here as you tick, so you can see what is still open.
Penetration testing terminology during the work
During testing you will hear about status updates and escalation. Escalation means a serious issue is reported at once, rather than waiting for the report.
You may also hear about a pause. Because the rules allow either side to stop work, a pause is a normal safety step, not a failure.
Penetration testing terminology in the report
A finding is one weakness, with evidence. Severity says how serious it is, often using a common scale. A chain is several findings that combine into a larger impact.
Then the remediation section explains fixes. Finally, an executive summary puts the result in business terms.
Words you meet after the test
A retest checks whether fixes worked. An attestation letter is a short statement that a test took place, often shared with customers instead of the full report.
Similarly, risk acceptance means a business owner decided, in writing, not to fix something yet. As a result, the decision is recorded rather than forgotten.
The one word that matters most
Authorization comes first, because computer misuse laws such as the UK Computer Misuse Act 1990 turn on it. So no glossary entry matters until the owner has signed.
Full engagements run from $35,000 to $120,000, while the floor is $25,000. Also, the bounded External Attack Surface Review starts at $4,500. Moreover, its fee is credited in full against a full engagement commissioned within ninety days. Every fee is agreed in writing before anyone starts.
Penetration testing terminology questions
What is the most important penetration testing terminology to know?
Scope and authorization, because they decide what may legally be tested.
Is a retest part of penetration testing terminology?
Yes. It means checking that fixes worked.
What is a chain?
Several findings that combine into a larger impact.
Where is penetration testing terminology defined?
In the proposal and contract. Ask the firm to define any unclear term in writing.
Related guides
Ask about any penetration testing terminology
Send your questions with a short brief. We answer in plain English and reply with a written scope and a fixed fee.
Ask about authorised testing