Preparing for
a pentest.

The first step is deciding what is tested and why: a specific application, an infrastructure, an external perimeter. The clearer the goal (check a new version, prepare for a client audit, test an exposure), the more relevant the test. This framing is done together in a first conversation and leads to a written proposal.

No test starts without written authorisation signed by an entitled person. If the system tested isn’t yours (host, SaaS vendor, cloud provider), the owner’s agreement is also required. That document, with the validated scope, is what separates a legitimate test from an intrusion (articles 323-1 et seq. of the French Criminal Code).

Depending on the chosen approach (black, grey or white box), you may need to provide test accounts, VPN access or documentation. Dedicated test accounts with representative rights are better than your real accounts. See the levels of information to pick the approach.

• A reachable contact for the whole engagement, for surprises and critical findings.
• Agreed testing windows (hours, days) to limit impact on operations.
• Forbidden actions and stop conditions, defined in advance.
• The choice of informing your teams or not (a blind test also measures detection and response).

Tests are carried out without destructive actions, and denial of service stays out of scope. It’s still wise to have recent backups and to test knowingly on sensitive systems. Any critical vulnerability found along the way is reported to you immediately, without waiting for the report.

Once these are settled, the engagement runs through a six-step walkthrough, from scoping to retest. A budget question? See how much a penetration test costs.