How to Get a Penetration Test.

File · Answer first

Answer first

File · Step 1.

Step 1. Define your scope and your driver

Before you contact anyone, write down two things: what you want tested, and why you are testing it now. The "why" is not a formality. A SOC 2 or PCI deadline, an M&A diligence request, a board mandate, a customer security questionnaire, and a genuine "we think we have exposure" each point at a different scope, a different depth, and a different report. A compliance-driven test that has to satisfy an auditor is a different engagement from a red team built to answer "could someone actually get to our crown jewels." Name the driver and the scope follows.

What to write down before the first call: the applications, environments, and networks in scope; the compliance framework if there is one; whether you need a report an auditor will accept; and your hard date, if you have one. If you only have a rough idea, that is fine. A good vendor will tighten the scope with you on the scoping call. A vendor that scopes you blind off a web form is telling you something.

Operator Note

Watch for

File · Step 2.

Step 2. Build a two or three vendor shortlist

Three vendors is the right number. Two does not give you signal to compare; five wastes everyone's calendar, including yours. You are not looking for the most logos on a homepage. You are looking for firms whose public, named people take positions you can read and disagree with, because a firm whose only public voice is a marketing team has nothing to defend when the work gets hard.

Pull your shortlist from people who do the work in the open, referrals from peers who have actually been through an engagement, and firms whose published positions match the depth you need. If you want to compare named firms head to head, the seven side-by-side reads under /compare cover the largest offensive shops in the market on the dimensions that separate them.

File · Step 3.

Step 3. Request written proposals

Send the same scope to all three and ask for the proposal in writing. The fastest way to surface a vendor's real position is to send the twelve-question checklist and require written answers. If they will not commit in writing, that is the answer.

Read each proposal for four things specifically. Who is the named delivery operator, not the named sales contact. Whether the retest is unlimited and untimed or itemized and metered. What the artifact destruction policy is, in days, with a written attestation. And whether the price is fixed post-scoping or an hourly estimate that can drift. A proposal that names the operator, commits the retest policy, and fixes the fee is a proposal you can actually compare.

Operator Note

Watch for

File · Step 4.

Step 4. Take a scoping call with the operator

This is the step that decides the engagement. Insist that the person on the scoping call is the senior operator who will run the test, not a sales engineer who hands you off after signature. A scoping call is a technical conversation: the operator is pressure-testing your scope, surfacing the attack surface you forgot to mention, and telling you where the real risk probably sits. A sales call is a commercial conversation about price and timeline. You need both, but if you never speak to the operator before you sign, you are buying a name on a cover and getting a bench you have never met.

At Alacrinet this is not an upgrade. The senior operator who scopes the engagement is the one who runs it. There is no junior bench staffed to senior names.

File · Step 5.

Step 5. Run the engagement

Once the SOW is signed and access is arranged, the operator runs the test. A real manual engagement is not a scanner pointed at your perimeter with the output pasted into a template. It is a senior operator chaining findings from first foothold to business impact, by hand, validating every result so you are not handed a wall of false positives to triage.

What you should expect during the engagement: a defined start and end, a clear line of communication to the operator, and immediate escalation if something critical and exploitable is found rather than a surprise at the readout. At Alacrinet, critical findings flagged within 24 hours is the standard, a < 24hr Critical Finding SLA. You should not learn about a live, exploitable hole for the first time when the report lands.

File · Step 6.

Step 6. Sit the report and the readout

A penetration test is only as useful as the report it produces and the conversation that explains it. The report should give you each finding with reproduction steps, real business impact rather than a raw CVSS dump, and remediation guidance an engineer can act on. The readout is where the operator walks your team and your leadership through what was found, what it means, and what to fix first.

Two things to weigh here. First, the report is the product, so read a sample before you sign, not after. Second, a firm that publishes no case studies is not hiding weak work; for many serious offensive firms, including Alacrinet, declining to turn client engagements into marketing is a deliberate confidentiality stance. Judge the report quality from a sanitized sample and from references on request, not from a logo wall.

File · Step 7.

Step 7. Remediate and retest

You fix what was found, then the operator validates the fixes. This is where a lot of buyers get quietly charged twice. Confirm before you sign whether retest is included or billed per finding. Per-finding retest charges create a perverse incentive and turn remediation into a metered transaction.

At Alacrinet, remediation validation is unlimited and untimed on every engagement. You remediate, the operator confirms the fix actually closed the hole, and you get a clean record for your auditor or your board. That closes the loop the test opened.

File · How long

How long does it take

Plan for four to eight weeks from first call to final report for a typical mid-market engagement, and budget more for a large multi-environment or red team scope. The testing window itself is often the shortest part. Scheduling the engagement, arranging environment access, and the remediation-and-retest cycle usually take longer than the active testing. If you have a hard compliance date, work backward from it and start the vendor conversations earlier than feels necessary, because the scoping call and proposal cycle alone can eat a week or two.

Operator Note

What you need before you start