How Is the Scope of a Penetration Test Determined?

The success of a penetration test does not depend solely on the tools used during the test or the technical expertise of the specialists. A properly defined test scope forms the foundation of a successful test.

A penetration test with an improperly planned scope can result in critical systems being overlooked, inaccurate risk assessments, and incomplete reporting. In contrast, a test plan tailored to the organization’s needs reveals the actual attack surface, ensures that critical risks are prioritized, and produces meaningful results for both technical teams and management.

For this reason, the first step in professional penetration testing projects is always the scope definition phase.

What Is the Scope of a Penetration Test?

Penetration testing scope is the technical and operational planning that defines which systems will be tested, using which methods, within what timeframe, and under what constraints.

In other words, the scope defines:

• Which systems are included in the test,
• Which systems are excluded from the test,
• Which methods will be used to conduct the test,
• The rules to be applied during the test,
• and the responsibilities of the parties

is the roadmap.

A properly prepared scope document protects both the client organization and the penetration testing team.

Why Is Scope Definition So Important?

In real life, many organizations make a request like this:

"We want to have our website tested."

However, the critical question here is:

Which website?

Because most organizations don’t have just a single system.

For example:

• Corporate website
• Customer portal
• Dealer portal
• Human Resources application
• ERP system
• CRM system
• Mobile App APIs
• Dashboards
• VPN services
• Active Directory
• Cloud infrastructure

may have different risk levels within the same organization.

Therefore, simply saying “website” is not sufficient.

A professional scope analysis requires a clear definition of all digital assets to be tested.

What Can Be Included in the Penetration Testing Scope?

Depending on the organization’s needs, the scope can be quite broad.

For example:

Web Applications

• Websites
• Customer portals
• ERP systems
• E-commerce applications
• Dashboards

API Services

• REST API
• GraphQL
• SOAP
• Mobile APIs
• Partner APIs

Network Infrastructure

• Firewall
• Switch
• Router
• VPN
• Reverse Proxy
• DMZ

Servers

• Windows Server
• Linux Server
• Web Server
• Database Server
• File Server

Identity Management

• Active Directory
• LDAP
• Azure AD
• Microsoft Entra ID

Cloud Environments

• Microsoft Azure
• AWS
• Google Cloud Platform
• Kubernetes
• Docker

Mobile Platforms

• Android
• iOS

Wireless Networks

• Enterprise Wi-Fi
• Guest Network
• Factory Wireless Networks

Industrial Systems

• SCADA
• PLC
• OT Network
• ICS

This scope may vary for each organization.

Factors Considered When Defining the Scope

In professional penetration testing projects, more than just a system list is prepared.

The following topics are also evaluated.

Test Environment

Will the test be conducted on live systems?

Or in a test environment?

While live environment testing reveals the actual security level, maintenance windows may need to be scheduled for some critical systems.

Test Time

Will the test be conducted during business hours?

On the weekend?

At night?

Especially in organizations with high user traffic, test scheduling should be planned to minimize operational impacts.

Critical Systems

Some systems may cause production to halt.

For example:

• Hospital systems
• Manufacturing facilities
• Banking infrastructure
• Energy systems

The testing techniques to be applied in such systems must be determined in advance and carried out in a controlled manner.

Authorized Accounts

Penetration testing;

• Black Box
• Gray Box
• White Box

Which of these approaches will be used?

Will a user account be provided?

Will an administrator account be provided?

Will the source code be shared?

This information directly affects the test methodology.

The Biggest Mistakes Made When Defining Scope

One of the most common problems encountered in the field is the incomplete or incorrect definition of scope.

For example:

❌Testing only the main domain

Forgetting subdomains.

❌Excluding API services from the scope

Ignoring the APIs running in the background while testing the web application.

❌Evaluating only the mobile app’s user interface

Considering the test complete without analyzing APIs and data communication.

❌Excluding Active Directory from the scope

Yet many ransomware attacks spread through the domain infrastructure.

❌Forgetting cloud services

Misconfigurations on Azure, AWS, or Google Cloud may be left untested.

What Does Proper Scope Planning Bring to an Organization?

Thanks to successful scope planning:

• Critical systems are thoroughly assessed.
• Time and costs are managed effectively.
• Test time is used efficiently.
• Realistic attack scenarios can be simulated.
• The formation of a false sense of security is prevented.
• Risk prioritization is performed more accurately.
• More meaningful reports are prepared for management.

In short, the right scope is the foundation of a successful penetration test.

Securesys Penetration Testing Approach

At SecureSys, we begin every project by conducting a scope analysis before technical testing.

During this process:

• All digital assets to be tested are identified.
• Critical systems are prioritized.
• A test plan is prepared that will not impact business continuity.
• The regulations to which the organization is subject are evaluated.
• The testing methodology is aligned with the scope.
• Expectations and limitations are clearly defined in writing.

Thanks to this approach, both the organization and the testing team work toward the same goal, and the findings obtained at the end of the test become much more accurate and actionable.

Once the scope of the penetration test has been properly defined, the next important decision is the perspective from which the test will be conducted.

Should the test proceed without any prior knowledge of the system? Or with limited user information? Or should the test be conducted with full access to the architecture and source code?

The answers to these questions lie in the Black Box, Gray Box, and White Box penetration testing approaches.