Home / Knowledge hub / Penetration test scope
Knowledge hub
Penetration test scope
The written list of what a pentest may and may not touch.
What it means
Penetration test scope is the written agreement on what will be tested and what will not. It names the applications, domains, APIs and environments in range, the accounts the tester will use, the kinds of testing allowed, and anything off limits, such as third-party services you do not own. It is usually part of the statement of work or the rules agreed before testing starts.
It protects both sides. The tester knows where they may work, and the client knows what will be touched. Anything outside the scope is not authorised, even if it looks connected. Nothing is assumed, and nothing should be tested that has not been written down.
Why it matters
Scope sets the value of the result. A test that leaves out the API, the admin area or a key integration will report a tidy result on the wrong thing. A report is only a statement about what was in scope, and a reader should know exactly what that was.
It is also a legal and safety matter. Testing systems you do not own, such as a payment provider or a hosting platform, may break their terms or the law. Written authorisation and scope prevent that. Compliance rules such as PCI DSS also expect scope to be defined.
How it shows up
A good scope document lists targets by name and address, environments, user roles with test accounts, testing windows, allowed techniques, data-handling rules and emergency contacts. It states what is out of scope and why. It also records the test type: black-box, grey-box or white-box.
Mistakes repeat: scope that names the main website but forgets the mobile API, a shared environment that nobody has approved, and scope changed by chat message mid-test. Update it in writing, keep a version, and tie it to your rules of engagement.
Questions people ask
Penetration test scope, answered
Who writes the scope?
Usually the client and the tester agree it together. The client knows what matters and what is fragile. The tester knows what must be covered to give a meaningful result.
Both sign it before the work starts.
What happens if the tester finds something out of scope?
They should stop and tell you rather than continue. Anything out of scope is not authorised, even if it is reachable.
You can then widen the scope in writing if you want it tested. Never assume that what is reachable is permitted.
Should third-party services be in scope?
Only with the owner's permission. Cloud providers and payment services publish their own rules for testing.
Test your own configuration and use of them, not their systems.
Can scope change during a test?
Yes, but record the change in writing before the work begins on the new target. Verbal agreements lead to disputes.
Keep the document versioned. Treat each change as a new approval.
How big should scope be?
Big enough to cover what protects your data and money, small enough to be tested properly in the time available.
A narrow scope done well beats a broad one done thinly.
Related
Terms that sit next to this one
Rules of engagement
The agreed limits, times and contacts that govern how a security test is run.
Penetration test
A time-boxed engagement where skilled people attack your systems by hand.
Web application penetration testing
A pentest focused on a web app, its APIs and the logic behind them.
Penetration test report
The document that lists what was found, how, how bad it is and how to fix it.
Black-box testing
Testing an app from outside, with no access to the source code.
What is in range, and what is not?
We test what is in scope, and the report says so. Findings come with the request and response, so you can see what was reached. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.