Penetration test scoping checklist
An interactive checklist of what pentest providers ask before they quote: scope, roles, API size, environments, limits and report needs. Copy the summary.
Short answer
Collect these answers before you contact providers: why you need the test and by when, every host and role in scope, API documentation, environments and test windows, off-limits actions, and what you expect back. Send the same summary to each provider so their quotes cover the same work.
Tick what you have ready and add short notes. The summary at the bottom updates as you go. Copy it into your email to each provider, so every quote covers the same scope.
0 of 28 ready
Your scoping summary
This summary stays in your browser. Copy it into your email to each provider so they all quote the same scope.
Why the same scope matters#
Two quotes can differ by several times for the same application, because each provider assumed a different scope: one tested two roles, the other six; one included the API, the other did not. When every provider answers the same summary, the differences that remain are real ones: delivery model, depth, report and retest terms. Compare those in the provider table, and read the cost guide for pricing models.
Questions
Is my checklist saved?
Your ticks and notes are saved in your browser's local storage on this device, so they are still there when you come back. Nothing is sent to us or to any provider.
Do I need every item before asking for a quote?
No. The first five items in each section matter most. Unknown answers are fine; say they are unknown, and the provider will ask. What matters is that every provider gets the same information.
What is the difference between black box, grey box and white box?
Black box means the tester gets no information, only the public application. Grey box means test accounts and documentation. White box adds source code. Grey box usually gives the most coverage for the time spent.
Compare like with like
An automated scan, a manual test and annual credits are different units. Check scope, delivery and retest terms before price.