How to scope a penetration test
Scoping a penetration test means deciding, in writing, what will be attacked, how deeply, from which starting point, when, and under which rules. A good scope names the targets and roles, chooses black, grey or white box, sets test windows and stop conditions, and states what is excluded. It is the single biggest factor in whether the test finds what matters.
Enterprise only. Cyber security is the one service ITovio offers at enterprise level: established companies and enterprises with production systems worth attacking properly. We do not sell low-budget scans or small-business security packages.
- Security and engineering leads preparing a request for a penetration test.
- Procurement teams comparing quotes that are not like for like.
- Founders and CTOs buying their first serious test for an enterprise customer.
Definitive results, not maybes
Proven, not suspected
Every finding in the report is exploited by hand and shipped with a working proof of concept, reproduction steps and evidence. No unverified scanner output, no "potential" issues padding the page count.
Ranked by business impact
Severity is scored with CVSS and then argued in plain language: what an attacker reaches, which data, which customers, what it would cost you.
Closed means closed
After you fix, we attack the same issue again. The retest report states, per finding, whether it is closed, partly closed or still open.
A clean result is still a result
If a target holds, the report says exactly what was attacked, how and for how long, so "nothing exploitable found" is evidence you can hand to a customer, auditor or board.
The scoping checklist
- Define the questionWhat decision will the test inform: a launch, a customer requirement, an acquisition, a board question? The question decides the depth.
- List the targetsApplications, APIs, mobile apps, cloud accounts, IP ranges and environments, each with its owner.
- Count roles and tenantsAuthorisation testing scales with the number of user roles and whether data is separated between customers.
- Choose the viewBlack box (no information), grey box (accounts and documentation) or white box (code and architecture). Grey box usually finds the most per day.
- Set the starting pointsFrom the internet, as a logged-in user, as one compromised device, or from a leaked key.
- Agree windows and limitsTest hours, production or staging, stop conditions, excluded techniques such as denial of service or phishing.
- Name the contactsA technical contact, an emergency stop contact on both sides, and who receives critical findings.
- Sign the authorisationWritten permission from the owner of every system in scope, including third-party hosting where required.
- Agree the deliverablesReport format, executive summary, debrief and retest, and when each is due.
What decides how long it takes
- The number of distinct features, roles and tenants in each application.
- The number of API endpoints and whether they are documented.
- The size and complexity of cloud accounts and Active Directory.
- Black box testing takes longer to reach the same depth as grey box.
- Restricted test windows stretch elapsed time without adding testing days.
Asked before most engagements
How long does an enterprise penetration test take?
Should we test production or staging?
Do we need to tell our hosting provider?
Can you help us write the scope?
Reviewed by the ITovio security team on 3 November 2026.
Related
What is in our penetration test report
Read itGuidePenetration test vs vulnerability scan: the real difference
Read itServiceWeb application penetration testing
Read itServiceNetwork and Active Directory penetration testing
Read itAll specialist testing: Web application testing, API testing, Cloud testing, Network and Active Directory, Mobile app testing, AI and LLM testing, Red team and attack simulation.
Find out what an attacker would find first.
A 30-minute scoping call, then a written scope with targets, depth, windows and deliverables before you commit. Enterprise engagements only.
