How to prepare for a penetration test: a checklist for your team

A penetration test is time-boxed. Every hour testers spend waiting for access, chasing the right contact or testing the wrong environment is an hour not spent finding vulnerabilities. A little preparation makes a big difference.

1. Agree what you want to learn

"Test our app" is a starting point, not a goal. Better goals sound like: can one customer see another customer's data?, can a normal user become an admin?, or what could an attacker do from the internet alone? Clear goals shape the scope and the report.

2. Define the scope precisely

• Exact URLs, IP ranges, API base paths, mobile app builds or cloud subscriptions
• What is out of scope, such as third-party services you don't own
• Which environment: production or a staging copy. Staging is safer; production is more realistic. If you choose staging, make sure it matches production.

3. Prepare access

• Test accounts for every role (user, manager, admin), ideally two of each so testers can check whether users can reach each other's data
• API documentation or a Postman collection
• For mobile apps: a test build, plus any steps to disable certificate pinning in that build if you want deeper API coverage
• VPN or IP allow-listing if the targets aren't public

4. Tell the right people

Let your hosting provider, SOC or managed security provider know the testing window and the testers' source IP addresses, so the test isn't mistaken for a real attack, unless detection is part of what you're testing. Name one technical contact who can respond quickly during testing.

5. Handle the paperwork early

• A signed NDA and a written authorisation to test, signed by someone with authority over the systems
• Rules of engagement: testing hours, prohibited techniques, and what happens if a critical issue is found
• If systems are hosted with a cloud or SaaS provider, check their testing policy

6. Plan for the results

Book time with developers for the week after the report arrives. Findings that sit unfixed for months give no protection. Agree who owns each fix, and schedule the retest.

Every engagement with us starts with a short scoping call where we work through this list with you. Request a quote to get started.