Key takeaways
- Agree scope and rules in writing
- Provide working test accounts
- Plan time to fix and retest
A test that spends its first three days waiting for VPN access and a working login is a test you paid for and did not get. A little preparation avoids that.
Before the test
- A written scope: which applications, APIs and environments are in, and what is off limits.
- Rules of engagement: testing windows, contacts and what happens if something breaks.
- Working test accounts for each user role, checked the day before.
- A staging environment that matches production closely.
During the test
- A named contact who answers questions within hours.
- Monitoring left switched on, so your team can see what an attack looks like in your own logs.
After the test
- Findings ranked by risk, each with a clear fix.
- Time set aside in the next sprint for critical and high findings.
- A retest to confirm the fixes hold.
- A summary letter you can share with clients.
Have a question about this guide? Write to us or ask Colony, our AI guide.