What a penetration test includes and how to prepare for it
Scope, written authorization, findings report and remediation plan: the essentials before hiring a pentest.
A penetration test (pentest) simulates an attack by a third party, in a controlled way, to find vulnerabilities before a real attacker does.
What it includes
- Scope definition: which systems are tested (web applications, APIs, mobile apps, infrastructure) and what is left out.
- Rules of engagement: dates, schedules, allowed techniques and emergency contacts.
- Testing: reconnaissance, vulnerability discovery and verification that they can be exploited.
- Report: findings prioritized by risk, evidence and clear recommendations.
- Remediation plan: concrete actions and, if agreed, a new verification after the fixes.
Written authorization is essential
Every test must have written authorization from the owner of the systems. Accessing systems without permission can be a crime; in Colombia, for example, Law 1273 of 2009 criminalizes abusive access to computer systems.
How to prepare
- Take an inventory of your systems and who is responsible for each one.
- Define the scope and objectives: compliance, pre-launch validation, annual review?
- Notify internal teams and the providers that host the systems, if applicable.
- Make backups and define a communication plan for incidents.
- Appoint a person responsible for receiving the report and coordinating remediation.
Security testing for AI applications
AI applications add risks of their own, such as malicious instructions that manipulate the model, data leaks or agents with excessive permissions. It is worth including them in the scope when your organization uses AI agents or assistants.
Book a no-obligation diagnostic.
Tell us about your challenge. We reply in your language: Spanish, English, Italian, French or Portuguese.