How to prepare for a penetration test

Most delays and disappointing test results trace back to preparation: unclear scope, missing access, or stakeholders who found out about the test when something broke. An hour of preparation buys you days of better testing.

Why it matters

Tester time is the thing you are paying for. Every hour a consultant spends waiting for credentials or chasing scope clarifications is an hour not spent finding what an attacker would find.

The preparation checklist

• Agree scope in writing: exact systems, URLs and ranges in, and anything explicitly out
• Nominate a contact who can answer questions and act fast if something needs attention during testing
• Prepare access before day one: test accounts for each role, VPN access, allowlisting if agreed
• Tell the people who need to know: your IT team or provider, and anyone watching monitoring dashboards
• Decide up front how you want urgent critical findings communicated, and to whom
• Snapshot or back up fragile systems if testing production is unavoidable

Should you warn your whole team?

For most tests, yes: the goal is finding weaknesses, not surprising your staff. The exception is a red team exercise or phishing campaign, where a small trusted group approves the work and everyone else responds as they would to the real thing. Your provider should help you decide who is inside that circle.