A strong pentest starts before the first test. Scoping determines what can be assessed, how realistic the scenarios can be, and whether the final report will support decisions.
1. Define the business objective
“Test the application” is too broad. State the decision the assessment needs to support: a production launch, customer assurance, an architecture change, a partner API, or a review of a critical journey.
Identify the flows that matter most: registration, authentication, account recovery, payments, administration, imports and exports, invitations, and separation between organizations.
2. Build a verifiable scope
List the authorized domains, APIs, related mobile applications, user roles, and dependencies. Record excluded environments, third-party providers, and prohibited actions.
For a multi-tenant application, provide at least two test organizations and multiple roles. Without that separation, object-level authorization and tenant-context changes cannot be tested properly.
3. Prepare access and data
Create dedicated assessment accounts that represent real roles without reusing personal identities. Prepare representative synthetic data, MFA procedures, temporary API keys, and a secure channel for secrets.
Document controls that may block testing: WAF rules, rate limits, IP allowlists, anti-bot systems, magic links, and asynchronous integrations.
4. Control active testing
Define testing windows, emergency contacts, load limits, and a stop procedure. Explicitly decide whether destructive scenarios, social engineering, third parties, or production are excluded.
Clear authorization protects both parties and prevents valuable tests from being replaced by cautious assumptions.
5. Prepare remediation early
Do not wait for the report to identify owners. Include product, development, infrastructure, and security teams in the debrief. Agree on evidence format, severity language, and retest conditions.
A useful finding separates the symptom, root cause, exploitation path, business impact, and recommendation. A team that did not perform the test should still be able to reproduce and fix it.
Pre-assessment checklist
- Objective and authorized assets approved
- Test roles and organizations available
- Secrets delivered through an appropriate channel
- Exclusions and load limits documented
- Emergency contacts reachable
- Logging and backups verified
- Remediation owners identified
- Retest and closure criteria agreed
Preparation does not reduce the depth of a pentest. It creates more time for the scenarios that genuinely matter.