Pentesting is the short name for an authorized test whose scope, hours, and rules are fixed before testers start any work.
Scoping names the systems, the time window, the data that may be seen, and the person who can halt the work.
How it works
Teams use the short name in contracts, while the engagement itself is still a permitted test of listed systems.
A written scope is what keeps that work inside the owner permission and outside everything else.
Good scoping lists included hosts, excluded hosts, allowed hours, and whether live customer data is in bounds.
The outcome is a report of weaknesses for the owner to fix, not a set of instructions for breaking in.
Concrete examples
- A shop authorizes a night test of its order site and leaves the card processor outside the scope.
- A clinic allows testing only on a copied system so care systems stay out of the engagement.
- A contract names a duty manager who may stop the test if a critical service starts to fail.
Protective measures
- Write scope, dates, and stop rules before you give any tester an account or a network path.
- Leave production data and third party systems out unless each owner gives separate written permission.
- Ask for a findings report and require that testers remove any access they were given when the work ends.
- File the authorization with the change record so a later review can see the test was approved.
Related articles
What is a red team? describes an authorized adversary exercise aimed at detection and response.
What is a sandbox? explains the isolated environment used to review untrusted code without touching the host.
What is a security perimeter? explains the trust boundary that a written test scope ought to respect.