How a penetration test works

What happens, in order

1. ScopingA call of around thirty minutes. We confirm the targets, user roles, environments, deadlines and any audit the test supports. You receive a written scope and a fixed-price proposal sized in tester-days.
2. Authorisation and rules of engagementBefore anyone touches a system, you sign written authorisation. The rules of engagement record test dates, our source IP addresses, out-of-bounds systems, safe hours for production, and who to call if something looks wrong. Where a third party hosts your systems, we confirm their testing policy first.
3. TestingTesters map the attack surface, then work through it by hand, using OWASP, PTES and NIST SP 800-115 as the backbone. Tools widen coverage; people decide what to try next. Exploitation stays within the limits you agreed.
4. Real-time critical alertsIf we confirm a critical issue, such as exposed customer data or a route to full admin access, your named contact hears about it straight away with enough detail to act. You do not wait for the report.
5. ReportingA single document written for two audiences: leaders who need the risk in one page, and engineers who need to reproduce and fix each issue.
6. DebriefA call with your team to walk through the findings, agree priorities and answer questions about fixes.
7. Retest & attestation letterWhen you tell us fixes are live, we re-check each reported issue at no extra cost, update its status and issue a letter summarising the test and its outcome that you can share with customers or auditors.