October 14, 2026
Before You Refer a Client for a Pentest, Collect These Details
A client says, “We need a penetration test.”
By sarthak
1 min read
You introduce a provider. Then the questions begin: Which applications are in scope? Are APIs included? Which user roles exist? Is production testing permitted? What deadline must the report meet?
Without these answers, a referral can turn into a chain of clarification emails — and the resulting scope may miss what the client actually needs.
Build a useful referral brief
Before introducing a penetration-testing partner, collect six essentials.
- The business trigger
Why is the client seeking an assessment now? An audit, enterprise customer request, product launch or internal security concern can affect priorities and deadlines.
- The technical scope
Identify the applications, APIs, mobile apps, environments and other systems that may be in scope. Confirm ownership and authorisation rather than assuming every connected system is available for testing.
- Roles and critical workflows
Explain the important user roles, tenant boundaries and business processes. For a multi-tenant SaaS product, for example, the scope may need to address whether one customer can access another customer's data.
- Environment and operational constraints
Clarify whether testing will take place in staging, production or both. Identify maintenance windows, rate limits, prohibited actions, escalation contacts and stop conditions.
- Evidence and confidentiality requirements
Ask what the client needs from the final report, who will review it, how sensitive evidence should be handled, and whether there are specific audit or customer requirements.
- Deadline, ownership and closure
Record the target date, decision-maker, technical contact, known exclusions and expectations for remediation and retesting.
Do not collect more sensitive information than necessary
A referral brief should provide enough context to define a meaningful scope without circulating unrelated secrets or customer data. Use an approved secure channel for sensitive material, and record missing inputs as open questions rather than making assumptions.
The result: a better-defined engagement
A structured intake helps the client and testing provider agree on the objective, authorised boundary, expected evidence and constraints before work begins.
It also helps the provider identify what still needs clarification instead of presenting uncertain coverage as confirmed.
Making a pentest referral? Start with the business trigger, system inventory, identities, critical workflows, deadline and constraints.
Read the full guide: https://www.wimd.in/resources/vapt-planning-vendor-selection/client-information-before-pentest-referral