Cyber insight

Penetration testing is not a permission slip.

Authorisation, scope, rules of engagement and remediation ownership are what make testing defensible.

Request a scoping call

Pegasus editorial team · Reviewed 21 July 2026

Who this helps

Built around a buying situation.

Technology and security buyers
Asset owners
Project teams commissioning testing

Useful when

The trigger is already visible.

A supplier has quoted before assets and objectives are agreed
Testing safety and authority are ambiguous
The report destination and remediation route are unclear

The position

Scope is the first security control.

A penetration test is authorised interference with a system. Its quality depends on precise ownership, targets, exclusions, depth, timing, safety, communications, evidence handling and the decision the report must support.

A defined scope and accountable decision owners

Controls matched to the real operating context

Evidence that can be reviewed, tested and improved

Scope

What the work includes.

Every engagement is scoped around authority, operating context, available evidence and the decision that must be made.

Authorise precisely

Confirm the asset owner, written authority, target inventory, objectives, environment and dependencies.

Test proportionately

Set techniques, exclusions, stop conditions, incident contacts, test data and evidence protection.

Verify remediation

Agree reporting audiences, severity context, remediation ownership, retest criteria and residual limitations.

Method

A controlled route from exposure to evidence.

Decision points, responsibilities and verification stay visible from the start.

Discover

Define the exposure, context, evidence, owners and decision that matters.

Design

Select proportionate controls and make responsibilities and hold points visible.

Implement

Embed the agreed system into the real operating workflow.

Verify

Test whether controls work and whether the evidence supports the conclusion.

Improve

Close actions, learn from exceptions and strengthen the system over time.

Outputs

Evidence designed for use.

Scope and evidence map

Prioritised findings and action ownership

Practical control or implementation pack

Verification record and next-step roadmap

Questions answered

Before you scope the work.

Can a broad scope be safer?

Not automatically. Ambiguous scope can increase operational and legal risk. Coverage should be complete enough for the decision but precise enough to control testing.

Who should receive the report?

Distribution should follow need-to-know, remediation authority and information sensitivity. An executive decision view and technical evidence may require different handling.

Authoritative references

NCSC: penetration testing guidance

External references support context; they do not imply endorsement of Pegasus.

Start the conversation

Bring the exposure. Leave with a controlled route forward.

A first conversation is used to understand context, authority and the decision required—not to force a predetermined package.