A speaker discusses what makes a penetration test effective, emphasizing transparency about methodology and specific tests performed, high-quality findings beyond raw scanner outputs, sufficient test duration (longer than a week or two) to avoid gaps, and clear reporting of which assets were tested and when they changed or became internet-facing.
Did they provide transparency into the methodology and the tests that they perform? Did they document that so you can see it, or are you just getting a report with three findings and that's it? So you want to kind of know how they did it and what was the outcome? So is there that transparency there? Did they even test for it? That is one thing that you want to know. And you can many times figure that out through a sample report. And then the quality of the findings, like, are they delivering things that are just output of vulnerability scanners, or are they going above and beyond what typical scann scanning tools discover and applying understanding to techniques and tactics that attackers use to show you what the real impact is? And then lastly, did it go on for a week or more? If it's just a short time period, they're gonna not test for a lot of things and there's gonna be significant gaps in the discoveries that they've made. So if your test went for a week or two, that's not gonna cut it. They're not gonna be able to get to testing all the things that they need to, to accurately tell you what where your risks are in your organization. And then can they tell you what assets were tested? When and when did those assets last change or become discovered? Was it that you had the system always on the Internet or did it change recently so this risk was just discovered? If they can't tell you that information, then their approach is wrong.
