Most disappointing pen tests aren't the tester's fault. They were scoped wrongly: too narrow, testing the wrong system, or missing the access the tester needed. Ten minutes of preparation before a scoping call makes a big difference.
Start with the question you need answered
"We need a pen test" isn't a scope. Better starting points are:
- "A bank partner needs evidence our customer app and API are secure."
- "Could an attacker who phishes one employee reach client data?"
- "We're launching a new portal next month and want it tested first."
- "Our insurer and ISO 27001 auditor want an annual external test."
The question determines the test type, the starting point and the reporting you need.
What to prepare by test type
Web applications
- URLs and environments (production or staging, and whether staging matches production);
- number of user roles, with a test account for each;
- a rough count of pages, functions or workflows, plus anything sensitive such as payments, uploads or admin areas;
- any WAF or rate limiting that may need allow-listing.
APIs
- documentation (OpenAPI/Swagger or a Postman collection);
- number of endpoints and authentication method;
- test credentials or API keys for each role.
External infrastructure
- IP ranges and domains you own, including cloud-hosted assets;
- confirmation that you have authority to test them, including hosting provider rules.
Internal and assumed breach
- approximate number of hosts and sites;
- whether the tester starts from a standard laptop, a VPN account or a VM you provide;
- which systems are fragile or out of bounds.
Cloud
- providers and number of accounts or subscriptions;
- read-only access for a configuration review, and whether you want attack-path testing too.
Rules of engagement
Agree in writing: the in-scope targets, testing windows, emergency contacts, what is off limits (denial of service, social engineering, production data changes), and how critical findings will be reported during the test.
Common scoping mistakes
- Testing the marketing site instead of the application.
- Unauthenticated-only testing of an authenticated product.
- Leaving out the API that the mobile app uses.
- Forgetting third-party hosted components you are responsible for.
- Squeezing the days to fit a budget until the test can only skim the surface.
The bottom line
A good scope is short, specific and tied to a business question. If you're unsure, a scoping call should help you work it out, and you should leave it with a fixed price and a clear statement of what will and won't be tested.
FAQs
What information is needed to scope a pen test?
The business question, target URLs, IPs or cloud accounts, number of user roles and test accounts, API documentation, testing windows, out-of-scope systems and emergency contacts.
Talk to SMARTSEC
Want help scoping?
Fixed-price testing, scoped and delivered by a senior tester, with live findings on the SMARTSEC client platform.
Use our test estimator →