Define the intended conclusion
Are you assessing an application before release, investigating an authorization concern, or observing controls during a scenario? Engagements become comparable when the intended conclusion is explicit. A promise to assess a whole company leaves too many important questions unanswered.
Targets and access
Identify the systems, environments and responsible parties. Note tenants, interfaces and user roles. Authorization testing needs expected permissions and suitable test identities; OWASP illustrates this dependency for object-level access-control assessment.
Methods and boundaries
NCSC guidance on commissioning penetration tests covers technical boundaries, test types, timing, preparation and reporting requirements. Consequently, two similarly titled proposals may describe very different engagements. A black-box test without credentials and a targeted role assessment are not simply identical services at different prices.
Our suggested initial enquiry
Describe the objective in a sentence, then add the system type, approximate scope, known roles or tenants, preferred timing and constraints. Do not put credentials or full confidential vulnerability details into the first general enquiry. A technical overview is enough to begin defining the engagement.
What the result should make clear
Our suggested acceptance criteria include traceable coverage and exclusions, supporting evidence, interpretation of uncertain observations and actionable remediation requirements. Retesting should identify the finding revisited and the conclusion supported by the result.
Avoid the wrong comparison
More automated steps do not automatically mean stronger evidence. A bounded assessment with suitable test identities may answer an authorization question that an extensive external scan leaves open. What matters is whether methods and evidence fit the agreed objective.
Prepare a practical brief
The local scope-brief tool on this website helps assemble an initial overview. It does not assess systems or transmit entries. Its output supports an enquiry; it is not a completed quotation or testing authorization.
Related assessment
Related reading
Primary sources checked on 26.09.2026.
Sources and limitations are identified in the article.