These cookies are required for the website to function properly. They ensure security, enable basic features like page navigation, and store user session data. You cannot disable these cookies.
- Penetration Test Management
- Who it's for
- Internal security teams
Internal security teams
Internal teams can keep each testing authorization tied to a named client group or business sponsor, a target set and dates. The lead reviews that scope before testers enter findings.
How Penetration Test Management is set up for you
Define the boundary
Record the client name, authorized targets, testing start and end dates, and authorization document for the first engagement. Make the scope readable to the tester before an issue is entered.
Work from evidence
Link each security finding to the engagement and identify its affected asset, severity and evidence. Review the status during remediation and again at retest.
Keep decisions visible
When inspection work applies, the assigned person records requirement checks and the reviewer decides whether the inspection is accepted or rejected. Failed checks keep their evidence.
Internal teams can keep each testing authorization tied to a named client group or business sponsor, a target set and dates. The lead reviews that scope before testers enter findings.
Start with one engagement whose targets and testing dates everyone recognizes. Record one representative security finding and take it through remediation and retest. Ask a second person to open the linked scope and explain what was authorized. This makes unclear target wording visible before the team takes on a broader set of work.
If your team also runs inspections, use one assigned inspection with a passing and a failed check. Review the failed evidence, record the disposition, and create a linked issue if the scope is rejected. Give the corrective action a named owner and have another person check effectiveness. Keep audit findings and document acknowledgments in the same pilot only when those records are part of your operating cycle.
Agree who may change engagement scope, who decides an inspection outcome, and who checks corrective effectiveness. Confirm that each owner can find the relevant record without relying on a private spreadsheet or conversation. See [implementation](/penetration-test-management/implementation) for the setup sequence and [the data model](/penetration-test-management/data-model) for the linked records.
Features to start with
Roles on the team
- Admin
- Configure access and reference records.
- Security Lead
- Confirm authorized scope and review finding outcomes.
- Tester
- Record observed issues and supporting evidence.
- Inspection Reviewer
- Decide inspection disposition and assess required checks.
Set up Penetration Test Management your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.