Booked your first penetration test? Great decision. A little preparation saves days of back-and-forth — use the checklist below and tick things off as you go.
Your checklist
0/5Tick items off as you complete them.
Before the kick-off
Decide what you want to learn from the test and which systems matter most. Collect URLs, IP ranges, app builds and any API documentation.
Create test accounts for every user role, and agree testing windows and emergency contacts.
Choosing the environment
Testing a staging environment that mirrors production is safest. If that is not possible, we can test production with agreed time windows and limits. What matters most is that the environment behaves like the real thing.
Telling your team
Let your IT, hosting provider and support teams know when testing happens, so unusual activity is not mistaken for a real attack. Share an emergency contact in case anything needs to be paused.
During testing
Keep a technical contact available for quick questions. Expect critical issues to be shared immediately rather than at the end.
After the report
Hold a walkthrough with your developers, fix the highest-risk issues first, and schedule the retest. Keep the final report and closure letter for audits and customers.
How our team helps
- 01Run a scoping call and confirm rules of engagement
- 02Share critical issues immediately, not at the end
- 03Give daily status updates on request
- 04Walk your team through every finding
- 05Retest fixes and update the report
- 06Help you choose the right environment
- 07Share our testing IP addresses in advance
- 08Pause immediately if anything looks unexpected
Got everything ticked? Send us a message and we can usually start within a week.
— The CRIS InfoTech security team