scoping

A penetration test is a controlled, authorised simulation of an attacker with a scope, rules and a report. The legal and planning parts are what separate it from an attack.

Turn a threat model into an executable agreement: authorized work, real checks, controlled effects, protected evidence and clear stop and restart decisions.

Distinguish a lead, a blocked consequence and a supported violation. Build a finding from requirements and evidence without discarding confirmed one-off events.

Respond to a suspected credential exposure without testing it against an excluded service. Preserve restricted evidence and coordinate owner-led containment.