Penetration Test Scope: What Vendors Ask Before They Quote

A penetration test scope defines what gets tested, how it’s tested and what stays off-limits: the target systems, the testing approach, the rules of engagement and the exclusions. Under PCI SSC guidance, “All penetration testing should only be conducted as defined by the rules of engagement agreed upon by both parties.”

Everything in scope turns into tester-days, which we quote as one fixed price with no hidden fees. A standard web application or API test costs $2,500 to $5,500 (see penetration testing pricing). A typical test takes 1 to 3 weeks of active testing, plus a few days for the report, as covered in how long a penetration test takes.

What is included in a penetration test scope

A complete penetration testing scope covers four areas:

• In-scope assets: The exact IP ranges, domains, user roles, API endpoints and AWS accounts or Azure subscriptions you authorize, plus the web application, API or mobile app under test.
• Testing approach: PCI SSC guidance says: “In a black-box assessment, the client provides no information prior to the start of testing.” Gray box adds partial details and white box full details. Testing with credentials and documentation (gray box) can save the tester-days black box testing spends on reconnaissance. For a side-by-side view, see black box vs white box penetration testing.
• Attack surface: Which layers get tested, such as an external network (internet-facing hosts and login portals), an internal network (inside the perimeter, including lateral movement), application business logic and the OWASP Top 10, or a cloud environment (AWS or Azure).
• Rules of engagement: The testing window, the environment (production or staging), when testing stops and an emergency contact list, which PTES recommends creating. We report critical vulnerabilities during the test. Scope sets what is tested; see what to agree in the rules of engagement for how.

What is excluded from scope

If an asset isn’t written into the scope, ask before anyone tests it. PTES warns: “Anything that is not explicitly covered within the scope of the engagement should be handled very carefully.”

• Out-of-scope assets: Third-party services, shared hosting and any system you neither own nor have explicit permission to test. Microsoft’s cloud testing rules prohibit any interaction with data or systems you don’t own or have explicit permission to access.
• Destructive actions: Denial-of-service and load testing aren’t part of our penetration tests. The AWS penetration testing policy also prohibits DoS attacks or simulations against any AWS asset, including your own.

What vendors ask before they quote

Most pentest scope questions fit a short list you can answer before the first call:

• What type of system and how big: Web app, API, internal network, cloud or mobile, plus the number of user roles, endpoints or hosts. A SaaS launch, for example, is often scoped as a gray box web app and API test covering all user roles, multi-tenant isolation, the public API and authentication flows.
• Your primary goal: General hardening, a pre-launch review or audit evidence for PCI DSS Requirement 11.4, GDPR Article 32 or NIS2. A pentest supports your audit. It doesn’t certify compliance. If GDPR is the driver, our GDPR pentest guide explains what Article 32 asks for.
• Environment and testing window: Production or staging, preferred dates and any audit or customer deadline.
• Retest: Say if you want one. A retest is available after fixes.

Our penetration testing quote page lists what to send for each test type. Once the scope is agreed, a checklist of what to prepare before, during and after the test covers access, backups and cleanup.

Sources: PCI SSC Penetration Testing Guidance v1.1; PTES Pre-engagement Interactions; AWS Penetration Testing policy; Microsoft Cloud Penetration Testing Rules of Engagement.