These cookies are required for the website to function properly. They ensure security, enable basic features like page navigation, and store user session data. You cannot disable these cookies.
- Penetration Test Management
- Who it's for
- Service operators
Service operators
A service operator can pair authorized security testing records with internal inspections, audit findings and controlled documents. The quality reviewer keeps failed checks and corrective action history visible.
How Penetration Test Management is set up for you
Define the boundary
Record the client name, authorized targets, testing start and end dates, and authorization document for the first engagement. Make the scope readable to the tester before an issue is entered.
Work from evidence
Link each security finding to the engagement and identify its affected asset, severity and evidence. Review the status during remediation and again at retest.
Keep decisions visible
When inspection work applies, the assigned person records requirement checks and the reviewer decides whether the inspection is accepted or rejected. Failed checks keep their evidence.
A service operator can pair authorized security testing records with internal inspections, audit findings and controlled documents. The quality reviewer keeps failed checks and corrective action history visible.
Start with one engagement whose targets and testing dates everyone recognizes. Record one representative security finding and take it through remediation and retest. Ask a second person to open the linked scope and explain what was authorized. This makes unclear target wording visible before the team takes on a broader set of work.
If your team also runs inspections, use one assigned inspection with a passing and a failed check. Review the failed evidence, record the disposition, and create a linked issue if the scope is rejected. Give the corrective action a named owner and have another person check effectiveness. Keep audit findings and document acknowledgments in the same pilot only when those records are part of your operating cycle.
Agree who may change engagement scope, who decides an inspection outcome, and who checks corrective effectiveness. Confirm that each owner can find the relevant record without relying on a private spreadsheet or conversation. See [implementation](/penetration-test-management/implementation) for the setup sequence and [the data model](/penetration-test-management/data-model) for the linked records.
Features to start with
Roles on the team
- Admin
- Configure access and reference records.
- Inspection Reviewer
- Decide inspection disposition and assess required checks.
- Effectiveness Reviewer
- Assess a completed corrective action independently.
- Auditor
- Plan audits and record requirement findings.
Set up Penetration Test Management your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.