Client Guide for those who hire their first penetration test

Is this your first penetration test?

If your company has never hired a penetration test, it's normal that you don't know exactly what to request, which systems need to be evaluated, what information you should provide, or what documents you need to prepare.

It is possible that a client, business partner, auditor, or your own team has requested a penetration test (pentest), a security analysis, or a report that allows you to understand the protection status of your systems.

It is also possible that you have received a request that does not specify the technical details needed to perform the assessment.

You don't need to have all the technical answers before reaching out to AlcaNox.

Our goal is to help you understand what you need, identify available information, and progressively define the work that will be carried out. We will guide you during planning so you can review and understand the proposed service before authorizing its execution.

We do not expect you to design a penetration test on your own. Your understanding of the business, the systems you use, and the request you received forms the starting point for defining the assessment.

2. Where should you begin?

The first step is to understand why you need the assessment and what outcome you expect to achieve.

To begin the conversation with AlcaNox, you can share the information you already know, although you may not yet have a complete technical inventory.

Initial information that can assist us.

• Reason for the request: Explain whether the test was requested by a customer, auditor, business partner, your company's address, or an internal initiative.
• Indicate exactly what you asked for.
• System that could be assessed: Indicates whether it is a web page, application, API, network infrastructure, or another technology environment. If you're not sure, we can help clarify this for you.
• Expected outcome: explain whether you need to identify vulnerabilities, obtain a technical report, prepare an executive summary, or respond to a specific request.
• Date limit: Indicates if there is a delivery deadline or a commercial commitment to consider.
• Known restrictions: mention any operational limitations, reliance on third parties or systems that cannot be disrupted.

This initial information helps us understand your need and determine which questions need to be addressed before preparing a proposal.

It is not necessary for all fields to be completed to start the conversation.

3. What happens if you don't know what type of test you need?

Not all security requests mean the same. For example, a company might request a vulnerability analysis when they actually need a penetration test.

Therefore, before defining the service, it is important to clarify what activity is expected and for what the results will be used.

AlcaNox can help you differentiate between the needs that must be analyzed during service definition:

• Vulnerability analysis: identify potential security weaknesses using techniques and tools aligned with the contracted service.
• penetration testing: assess the security of authorized assets through controlled activities aimed at investigating and exploiting vulnerabilities and, when applicable, their impact.

The description you received is the starting point, not necessarily the definitive test plan.

AlcaNox will help you identify what information is missing and which aspects need confirmation. The final acceptance of results by a client, auditor, or another requester will depend on their own requirements.

4 What is the scope and why don't you have to define it just yet?

In a security assessment, the scope defines which systems, components, environments, and activities can be included in the authorized work.

If you have never hired a pentest, it's possible you're unsure whether to include your website, APIs, administrative dashboards, different user types, or integrations with other providers.

You don't need to solve all these questions without assistance.

From the initial information, AlcaNox will guide you to identify the systems that may be involved, clarify any outstanding questions, and prepare a scope description you can review and approve.

During this phase we may need additional information such as:

• Applications, domains, IP addresses, APIs or components to be evaluated.
• Production environments, testing or development.
• Types of users and relevant access levels.
• Connected systems and integrations with external providers.
• Permitted activities, restrictions, and exclusions.
• Availability of test accounts and necessary access.
• Timing, operational conditions, and responsible contacts.
• Expected deliverables and report requirements.

The requested information will depend on the type of assessment and the assets involved.

Important: identifying a system during the initial conversation does not mean it will automatically be included in the testing. The assets and activities that can be evaluated must be defined and approved in the relevant documentation before starting.

5. What documents are involved and what is the purpose of each one?

To avoid confusion, AlcaNox organizes the definition and execution of the service through documents with differentiated functions.

5.1. SOW — Statement of Work

The SOW describes the work agreed upon between the parties. It clarifies the service to be provided, its objectives, the responsibilities of each party, and the deliverables that are planned.

In this stage, the expectations of the client are clarified and the general conditions of the assessment are defined, including the results we expect to receive.

5.2. Scope — Technical Scope

The Scope identifies specific assets, systems, environments, and activities within the assessment. It also allows setting exclusions, restrictions, technical limitations, and other conditions necessary to prevent misinterpretations about what is being evaluated.

The scope must be clearly defined so that both the client and the evaluator understand what is included and what is outside the authorized scope of work.

5.3. ROE — Rules of Engagement

The ROE defines the operational rules under which tests will be carried out. It outlines authorized timelines, primary and escalation contacts, communication channels, permitted techniques, restrictions, suspension conditions, and procedures for reporting relevant situations.

Their purpose is to establish how the assessment will be conducted and how situations that could impact security or operational continuity will be managed.

How do these documents relate to each other?

The SOW outlines the agreed work; the Scope defines what can be evaluated; and the ROE specifies under what rules authorized activities will be executed.

AlcaNox will accompany you throughout your definition so you can understand the service before approving it.

This guide is solely for reference. This does not replace the SOW, Scope, ROE, written authorization, contracts, or any other documents related to the service delivery.

6. What responsibilities will your company have?

A security assessment requires collaboration between the client and the evaluator team. AlcaNox will explain what information, permissions, and preparations are needed for the specific service that has been defined.

According to the agreed scope, your company must provide or confirm:

• Authorization: believe it has the capabilities to authorize the assessment or obtain the corresponding permissions from the owner of the systems.
• Information: provide sufficiently accurate data about the systems, their operation, and known restrictions.
• Accesses: prepare the accounts, roles, and access mechanisms that have been agreed upon.
• Contact information: designate a responsible person and, when appropriate, a escalation contact who can respond during the assessment.
• Restrictions: inform about sensitive processes, critical operations, external dependencies and prohibited activities.
• Operational preparation: coordinate, as appropriate, backups, monitoring, maintenance windows, and internal communications.
• Review of results: analyze the received findings and coordinate appropriate corrective actions.
• New tests: make verification of corrections easier when a re-evaluation service has been agreed upon.

AlcaNox will indicate which requirements apply and which need to be resolved before proceeding.

The responsibility of AlcaNox is to carry out the activities that have been agreed and authorized, communicate relevant limitations, and document the results obtained. The correction of vulnerabilities within the client's systems should be coordinated according to the responsibilities established for the service.

7. What should you prepare before starting the tests?

Once the objective has been clarified and the proposed scope developed, we will review whether the necessary conditions exist to perform the evaluation in a controlled manner.

Before starting, tasks must be completed, depending on the requirements.

1. The review and approval of the SOW and applicable documentation.
2. Identification of assets and authorized activities within the Scope.
3. The required written authorization to conduct the tests.
4. The review and acceptance of the ROE and operational conditions.
5. Confirmation of the accesses, accounts, and required permissions.
6. Identification of the responsible contacts and communication channels.
7. The confirmation of the restrictions, schedules, and suspension conditions.
8. Coordination of the necessary operational protection measures.

If there are third-party dependencies, it should also be verified that appropriate permissions exist before taking action on the affected assets.

If there is no authorization, a permit, a security condition, or an essential scope definition, the affected activities should not begin until the situation is resolved.

The initial conversation, sending information, or receiving a proposal does not by itself constitute authorization to conduct tests.

How the evaluation will proceed?

Once the conditions for initiation are met, AlcaNox will carry out the activities as specified in the contracted service and within documented limits.

During the work:

• Only assets and authorized activities will be evaluated.
• Technical and operational restrictions agreed upon will be respected.
• Communication channels established will be used to address queries and convey relevant situations.
• Potential findings will be investigated in accordance with the methodology and evaluation conditions.
• Limitations that may impact coverage or the interpretation of results will be documented.
• The suspension and scaling conditions will be applied as intended when necessary.

If during testing the need to broaden the scope is identified, changing a technique or incorporating a system not previously included, the modification will be reviewed and approved in writing before proceeding with the affected activities.

Similarly, if a situation is detected that could compromise system stability or exceed authorized conditions, action will be taken in accordance with established communication, escalation, and suspension rules.

9. What will you receive upon completion?

Deliverables will depend on the contracted service and the terms outlined in the SOW.

When applicable, the results may include a technical report describing:

• The purpose of the assessment.
• The systems and components covered in the scope.
• The actions performed and their limitations.
• The identified findings and relevant evidence.
• The description of the risk and its potential impact.
• Recommendations for addressing vulnerabilities.
• The limitations that prevent drawing conclusions about aspects not evaluated.
• The status of the new tests, when a reassessment has been contracted.

When an agreement is reached, you may also receive an executive summary aimed at business leaders or management, explaining the main risks and the actions that require attention.

The documentation will be prepared in accordance with the agreed deliverables and applicable confidentiality conditions.

The report presents the findings and limitations of the assessment conducted. It does not constitute a guarantee that a system is completely free from vulnerabilities or automatically confirms compliance with any external requirements.

If the test responds to a request from a client or auditor, it is up to that section to determine whether the results meet their requirements.

Limitation of liability regarding the expected results

AlcaNox does not guarantee the achievement of specific results and is not responsible for ensuring that evaluation outcomes meet the particular expectations of the client, third-party requirements, or business objectives that this seeks to achieve through the engagement of the service. The delivery of the service is limited to the activities and deliverables explicitly agreed upon.

10. What happens after the report?

The assessment does not necessarily have to end with the delivery of the report.

Once the results are received, your team can review the findings, prioritize corrective actions, and coordinate their implementation.

If the service includes a new test or a later reassessment is agreed upon, AlcaNox can verify the selected findings to determine whether the corresponding vulnerabilities continue to be reproducible under the conditions of the new test.

The reassessment should take into account the assets, findings, access conditions, timeframe, and approved activities for that work.

The result will allow us to document the observed state during the re-evaluation. It does not imply that all vulnerabilities have been fixed or that other system areas have been automatically assessed.

To avoid misunderstandings, the conditions, scope, and deliverables of the re-evaluation must be agreed upon before execution.

Common mistakes we will help you prevent

Misunderstanding a request with an approved scope

A generic request does not automatically determine which systems will be evaluated. We must first clarify the requirement and then define the authorized work.

Assume all connected systems are included

Ensure that all integrations, third-party platforms, and other assets are identified and have the necessary authorizations when applicable.

Failing to identify different types of user accounts

The permissions and available functions for each user can significantly impact the scope of an assessment.

Begin without sufficient authorization

The assessment requires the appropriate permissions and prior documentation. No testing will be conducted on systems whose authorization is not verified.

Assuming a penetration test guarantees absolute security

The assessment provides evidence about the systems, activities, and conditions that could be examined. Their results have defined limits.

Do not allocate time for corrections

The implementation of corrective measures may require technical coordination, internal testing, and planning. It makes sense to consider these timelines if there is an external deadline.

Deliver unnecessary sensitive information

To begin the conversation, you do not need to send passwords, private keys, access tokens, unnecessary personal data, production databases, or other secrets. If sensitive information is required to run the service, you must consider your need and the delivery mechanism through the appropriate channels and procedures.

Each assessment must address a specific need, have a clear scope, and be executed under explicitly authorized conditions.

Our priority is that you can make informed decisions before hiring the service, and that the work progresses with clear expectations, responsibilities, and defined boundaries.