Penetration Test Engagement

Contact Details
Name

First NameLast Name
Email
example@example.com
Phone Number

Area CodePhone Number
Would you like to engage us for pentesting your infrastructure, application, or both?

About Your Engagement ( INFRA )
What is prompting this penetration test?
(e.g. compliance requirement, security assurance, recent incident, audit finding)
What outcomes would make this engagement a success for you?
Who is the intended audience for the report?
(e.g. technical teams, executives, audit / risk committee)
Are there specific frameworks or standards the testing should align with?
(e.g. Essential Eight, ISO 27001, OWASP, PCI DSS)
When would you like testing to take place, and is there a deadline for the final report?
Has this environment been penetration tested before? If so, approximately when?
(e.g. Essential Eight, ISO 27001, OWASP, PCI DSS)

Environment Overview ( INFRA )
Please provide a brief overview of your environment
(e.g. approximate size, key systems, how it is used).
Where is your infrastructure hosted?
(e.g. on-premises, Azure, AWS, hybrid)
Are any significant changes planned for the environment before or during the proposed testing window?

External / Perimeter Scope ( INFRA )
Please list all externally facing assets in scope
(e.g. domains, subdomains, IP addresses / ranges, portals, VPN endpoints).
Is a WAF, load balancer or gateway in place? Should testing be performed through it, or with our source IPs allow-listed?

Exclusions & Constraints ( INFRA )
Are any systems, applications or functions explicitly out of scope?
Are there sensitive or fragile systems that require special care or should be avoided?
(e.g. legacy platforms, safety-critical systems)
Is social engineering in scope?
(e.g. phishing, vishing, physical entry)

Testing Windows & Operational Constraints ( INFRA )
When can testing occur?
(e.g. business hours, after hours, weekends)
Are there any blackout periods, change freezes or times when testing must not occur?
Testing environment

Retesting & Remediation ( INFRA )
Do you require retesting once identified issues have been remediated?
Should retesting be included in the initial quote, or priced as an optional extra?
What timeframe do you anticipate between receiving the report and remediation being ready for retest?

Reporting & Communication ( INFRA )
Do you require a debrief workshop or a presentation of findings to stakeholders?
How would you like critical vulnerabilities communicated during testing?
(e.g. immediate phone call, written notification within 24 hours)
Do you require regular status updates during testing?

Other
Who are the key stakeholders and points of contact for this engagement?

About Your Engagement ( APPS )
What is prompting this penetration test?
(e.g. compliance requirement, security assurance, recent incident, audit finding)
What outcomes would make this engagement a success for you?
Who is the intended audience for the report?
(e.g. technical teams, executives, audit / risk committee)
Are there specific frameworks or standards the testing should align with?
(e.g. Essential Eight, ISO 27001, OWASP, PCI DSS)
When would you like testing to take place, and is there a deadline for the final report?
Has this environment been penetration tested before? If so, approximately when?
(e.g. Essential Eight, ISO 27001, OWASP, PCI DSS)

Application Overview ( APPS )
Which applications are in scope? Please list application names and URLs.
Briefly describe what each application does and who uses it.
What technologies are the applications built with, if known?
(e.g. frameworks, languages, CMS, hosting platform)
Approximately how large or complex is each application?
(number of pages, modules or distinct functions)
Where are the applications hosted?
(e.g. Azure, AWS, on-premises, third-party SaaS)
Are any significant releases or changes planned before or during the proposed testing window?

Authentication & Access ( APPS )
How do users authenticate?
(e.g. SSO, Entra ID, local accounts, social login)
Is multi-factor authentication enforced? Are there any exceptions?
What user roles exist within each application?
(e.g. standard user, administrator, super admin)
Should unauthenticated (anonymous) testing be included in addition to authenticated testing?

Other

Integrations, APIs & Mobile ( APPS )
Does the application integrate with other systems or third-party services?
Are APIs in scope? If so, approximately how many endpoints, and is API documentation (e.g. OpenAPI / Swagger) available?
Are external identity providers or third-party services involved in authentication or key workflows?
Are there backend or downstream systems we should avoid interacting with?
Are any mobile applications (iOS / Android) in scope?

Test Environment & Data ( APPS )
Will testing be performed against production, a staging / UAT environment, or both?
If a staging environment is used, how closely does it mirror production?
(e.g. data, configuration, integrations)
Are there constraints around test data?
(e.g. real customer data in the environment, restrictions on creating / modifying records)
Are any in-scope systems hosted or managed by a third party? If so, are you authorised to approve testing of them?

Exclusions & Constraints ( APPS )
Are any systems, applications or functions explicitly out of scope?
Are there sensitive or fragile systems that require special care or should be avoided?
(e.g. legacy platforms, safety-critical systems)
Are there specific functions that should not be exercised during testing?
(e.g. live payment processing, features that send emails or SMS to real users)

Testing Windows & Operational Constraints ( APPS )
When can testing occur?
(e.g. business hours, after hours, weekends)
Are there any blackout periods, change freezes or times when testing must not occur?

Retesting & Remediation ( APPS )
Do you require retesting once identified issues have been remediated?
Should retesting be included in the initial quote, or priced as an optional extra?
What timeframe do you anticipate between receiving the report and remediation being ready for retest?

Reporting & Communication ( APPS )
Do you require a debrief workshop or a presentation of findings to stakeholders?
How would you like critical vulnerabilities communicated during testing?
(e.g. immediate phone call, written notification within 24 hours)
Do you require regular status updates during testing?

Other
Who are the key stakeholders and points of contact for this engagement?

Ready to submit ?
Once you submit this form, our security team will review the details of your pentest engagement and reach out to you to confirm scope, timelines, and any required prerequisites. We’ll work with you to validate your application or infrastructure targets, clarify testing objectives, and ensure all authorisations are in place before the assessment begins.

Expect a follow‑up email or call shortly outlining the next steps and any additional information we may need to proceed.
Please verify that you are human
Should be Empty:

Contact Details