How to Plan a Penetration Test, and What Drives Cost

Many owners ask how to plan a penetration test only after a customer or insurer demands one. By then the date is close and the questions pile up. What will it cover, who needs to be involved and why do two quotes look so different? This guide on how to plan a penetration test walks you through the steps in plain words, so you can brief a provider and avoid paying for the wrong thing.

What is a penetration test, in plain English?

It helps to start with the basic question of what is a penetration test. It is a controlled, authorized attempt by a skilled person to break into your systems, in the same way a criminal might. The goal is to find weak spots before someone else does. You then get a written report explaining what was found and how to fix it.

It is different from a scan. A scan is an automated check that lists known weaknesses. A test goes further, because a person tries to chain small weaknesses together and see what real damage is possible. If you only need the broad list, a vulnerability assessment may be the better and cheaper first step.

Why you should plan a penetration test before you buy

A test is only as useful as its plan. If the scope is vague, the provider guesses, the price swings and the results may miss what matters. A clear plan also protects you. Good planning does not need technical knowledge. It needs you to know your business, your priorities and the limits you want to set. Without one, a test could disrupt a live system on a busy trading day or touch a system you do not own.

How to plan a penetration test: start with what you protect

Start with the business, not the technology. A retailer may care most about the online shop and payment flow. A clinic may care about the patient portal. A software company may care about its customer-facing application and the cloud account behind it.

List the systems that would hurt most if they failed or leaked data. This list becomes your pen test scope, the exact set of systems, addresses and applications the provider may test. Our penetration testing services always begin by agreeing this scope in writing.

Pick the type of test that fits

Providers also talk about how much they know up front. This choice affects both cost and the value you get, so discuss it openly with them. In a "black box" test they start with nothing, like an outsider. In a "white box" test they get details such as diagrams and accounts. Giving more detail usually finds more problems for the same effort.

What affects the cost of a penetration test

We will not quote prices here, because they vary too much. Instead, here is what moves the price up or down. We can explain penetration testing cost factors so you can compare quotes fairly.

• Size and complexity of the scope, such as the number of applications, user roles and servers.
• Depth of testing, from a quick check to a thorough manual review.
• How much information you give up front.
• Whether testing happens inside or outside business hours.
• The quality and detail of the final report and any review session.
• Whether you include a retest to confirm fixes.

Two quotes can differ because one covers a single application while the other covers everything around it. Ask each provider to list exactly what is in and out. Also ask what happens if the work takes longer than planned, and whether extra effort is billed or absorbed. A clear answer now prevents an unwelcome surprise later.

Agree the rules of engagement

The rules of engagement are a short written agreement that sets the limits of the test. They protect both sides. They say what may be tested, when, from where and what to do if something breaks.

Your security provider and hosting vendor often have their own rules about testing. Check them first. Your own legal adviser should confirm that you have permission to test everything on the list. This matters most when systems are run by a third party, such as a hosting company or a software vendor.

Read the report and fix what matters

A useful penetration test report has two layers. A short summary tells leaders what the risk means in business terms. A detailed section gives your team the steps to reproduce each issue and a recommended fix. Findings should be ranked, so your team can start with the worst. Ask the provider for a short call to walk through the report, because questions are easier to settle in conversation than by email.

Then plan a retest. This is a second, smaller check after you have fixed the issues. It confirms the problems are gone and gives you evidence for a customer or auditor. For advice on choosing who should run all this, read how to choose a cybersecurity consultant.

How Kramate approaches this

Kramate begins with a scoping call and a written scope document, so the price follows the work rather than the other way round. We test with care around live systems, report findings in plain language and offer a retest. We tell you if a cheaper step, such as an assessment, would serve you better first. That is the right order for many first-time buyers.

Next steps

Planning is mostly a matter of writing things down. These three actions take little time and make any quote you receive much easier to compare.

1. List the three systems that would hurt most if attacked and write who owns each one.
2. Ask your hosting or cloud provider what their rules say about security testing.
3. Request written scoping questions from two providers and compare what each includes.

If you are still deciding who to work with, our guide on how to plan a penetration test pairs well with advice on hiring a security consultant. You can also contact us with questions at any stage.