Scope and rules of engagement
Agree written authority, targets, test depth, exclusions, timing, incident routes, data handling and stop conditions.
Penetration testing
Testing under written authority—with a route to closure.
Scoping, technical testing, risk translation and retesting within clear rules of engagement.
Request a scoping call
Precise authority, controlled testing and retest evidence make findings decision-ready.
Who this helps
Built around a buying situation.
- System and asset owners
- Technology companies
- Organisations preparing for customer or risk assurance
Useful when
The trigger is already visible.
- An internet-facing service needs independent challenge
- A material release requires security evidence
- Previous findings need remediation verification
The position
Precise authority. Useful findings. Verified closure.
A credible penetration test begins with permission and a decision-useful scope. Pegasus defines targets, exclusions, safety limits, communications and evidence handling before testing, then connects technical findings to exploitation conditions, consequence and an owned remediation route.
01
A defined scope and accountable decision owners
02
Controls matched to the real operating context
03
Evidence that can be reviewed, tested and improved
Scope
What the work includes.
Every engagement is scoped around authority, operating context, available evidence and the decision that must be made.
Evidence-led technical testing
Perform evidence-led testing against the authorised scope using proportionate manual and automated techniques.
Reporting, remediation and retest
Report reproducible findings, prioritise remediation in context and retest agreed fixes without overstating assurance.
Method
A controlled route from exposure to evidence.
Decision points, responsibilities and verification stay visible from the start.
Discover
Define the exposure, context, evidence, owners and decision that matters.
Design
Select proportionate controls and make responsibilities and hold points visible.
Implement
Embed the agreed system into the real operating workflow.
Verify
Test whether controls work and whether the evidence supports the conclusion.
Improve
Close actions, learn from exceptions and strengthen the system over time.
Outputs
Evidence designed for use.
Scope and evidence map
Prioritised findings and action ownership
Practical control or implementation pack
Verification record and next-step roadmap
Professional boundaries
Precision includes saying what the work does not claim.
- Only systems covered by written owner authorisation are tested.
- Testing is time-bound and cannot prove the absence of every vulnerability.
Questions answered
Before you scope the work.
How is penetration testing different from vulnerability scanning?
Scanning identifies potential weaknesses at scale. Penetration testing adds human validation, chaining and exploitation reasoning within agreed rules, helping distinguish theoretical alerts from demonstrated exposure.
What is needed before testing starts?
A confirmed asset owner, written authorisation, accurate targets, rules of engagement, named contacts, safe evidence handling and clarity on what decision the report must support.
Does a clean test mean the system is secure?
No. Results are limited by scope, time, access, technique and the state of the system during testing. The report records those limitations.
Authoritative references
External references support context; they do not imply endorsement of Pegasus.
Start the conversation
Bring the exposure. Leave with a controlled route forward.
A first conversation is used to understand context, authority and the decision required—not to force a predetermined package.
Request a scoping call