The quality of a penetration test is decided before it starts. Scope too narrowly and the critical finding sits just outside the boundary; scope too broadly and testers spread thin across surface that doesn't matter.
Define What You're Protecting
Start from assets, not URLs. What data or capability would hurt most if compromised? Customer PII, payment flows, admin functionality, tenant isolation — name them explicitly, then work backwards to the systems that guard them.
Choose the Right Perspective
- Unauthenticated external answers "what can an internet attacker reach?"
- Authenticated testing answers "what can a malicious or compromised user do?" — usually where the highest-impact findings live.
- Multi-tenant testing answers "can customer A reach customer B's data?" — essential for SaaS.
Be Honest About Environments
Testing staging avoids production risk but only counts if staging genuinely mirrors production — same code, same configuration, same integrations. Document every known difference.
Set Rules of Engagement Early
Agree on testing windows, rate limits, out-of-bounds systems, and an escalation contact before the engagement starts. Surprises during testing are avoidable with an hour of planning.