These cookies are required for the website to function properly. They ensure security, enable basic features like page navigation, and store user session data. You cannot disable these cookies.
- Penetration Test Management
- Who it's for
- Security consultancies
Security consultancies
A consultancy can separate engagements by client and preserve the authorization document beside the test window. Findings remain linked to each engagement so reviewers can see the affected asset and evidence.
How Penetration Test Management is set up for you
Define the boundary
Record the client name, authorized targets, testing start and end dates, and authorization document for the first engagement. Make the scope readable to the tester before an issue is entered.
Work from evidence
Link each security finding to the engagement and identify its affected asset, severity and evidence. Review the status during remediation and again at retest.
Keep decisions visible
When inspection work applies, the assigned person records requirement checks and the reviewer decides whether the inspection is accepted or rejected. Failed checks keep their evidence.
A consultancy can separate engagements by client and preserve the authorization document beside the test window. Findings remain linked to each engagement so reviewers can see the affected asset and evidence.
Start with one engagement whose targets and testing dates everyone recognizes. Record one representative security finding and take it through remediation and retest. Ask a second person to open the linked scope and explain what was authorized. This makes unclear target wording visible before the team takes on a broader set of work.
If your team also runs inspections, use one assigned inspection with a passing and a failed check. Review the failed evidence, record the disposition, and create a linked issue if the scope is rejected. Give the corrective action a named owner and have another person check effectiveness. Keep audit findings and document acknowledgments in the same pilot only when those records are part of your operating cycle.
Agree who may change engagement scope, who decides an inspection outcome, and who checks corrective effectiveness. Confirm that each owner can find the relevant record without relying on a private spreadsheet or conversation. See [implementation](/penetration-test-management/implementation) for the setup sequence and [the data model](/penetration-test-management/data-model) for the linked records.
Features to start with
Roles on the team
- Admin
- Configure access and reference records.
- Security Lead
- Confirm authorized scope and review finding outcomes.
- Tester
- Record observed issues and supporting evidence.
Set up Penetration Test Management your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.