DGNEXA · Göktuğ Yüksel
Preparing a small business for a penetration test
Agree scope, permission, business constraints and follow-up before a security test.
Start with a business question
A penetration test should investigate a defined environment and produce findings your business can act on. Decide what you want to assess: an externally exposed application, a network or a specific system. An automated scan and a penetration test are different activities; ask the provider to explain the proposed method and deliverables.
Agree permission and boundaries
Testing requires written authorisation from the appropriate system owner. Identify the systems in scope, exclusions, allowed times and the point of contact. Third-party or cloud environments may require additional permission. Do not assume ownership of an account gives permission to test every connected service.
Protect daily operations
Explain business-critical applications and acceptable testing limits. Agree how unexpected disruption is handled and when work must stop. Confirm secure handling of evidence and report access. Establish an escalation route for a serious finding so a time-sensitive issue does not wait for the final report.
Budget for remediation and retesting
Ask for prioritised findings, understandable business impact and practical remediation guidance. Assign an owner to each agreed fix and decide whether verification or retesting is included. A test reflects its scope and point in time; it does not certify that all future activity is secure. DGNEXA discusses the environment and written authorisation before confirming the scope and proposal.