How to Prepare for Your First Penetration Test
A practical checklist for your first penetration test: how to set scope, prepare accounts and environments, pick contacts and keep communication clear.
Free tool
Pentest Scope Estimator
Tell us roughly what you want tested and get an indicative range of tester-days: the unit every Rudranetra proposal is built on.
Runs entirely in your browser. Nothing you enter is sent to us.
Indicative effort
–
tester-days, including reporting
An indicative range only. Your proposal confirms exact tester-days after a short scoping call. A retest of findings is included in every engagement.
How to use the result
What the range means
A tester-day is one day of a qualified tester working on your scope. We scope every engagement in tester-days, so you can see exactly what effort you're getting.
The range covers testing plus reporting and the walkthrough. The low end assumes a well-prepared engagement: accounts ready, documentation available, a responsive contact. The high end allows for complex logic, many integrations or slower access.
What moves the number: complex business workflows, payment logic, SSO integrations, multiple environments, compliance mapping and tight deadlines. A short scoping call turns this range into a firm figure.
Background
Why we scope in tester-days
A tester-day is one day of a qualified tester's time on your systems. Stating effort in tester-days makes proposals comparable: you can see how much hands-on testing you get, rather than a single figure with no explanation behind it.
What the estimate is based on
- Web applications and user roles: each role sees a different version of the app, and authorization flaws hide in the gaps between roles.
- API endpoints: more endpoints mean more objects and actions to test for access control and input handling.
- Mobile platforms: iOS and Android apps are tested separately, along with the API behind them.
- Internet-facing IP addresses: each exposed service needs discovery and manual validation.
- Cloud accounts: each account, subscription or project has its own identities and configuration to review.
Getting the most from the days
Most lost testing time comes from access problems. Have test accounts for every role ready before kickoff, share API documentation if you have it, and name a contact who can answer questions quickly during testing. How we work explains each step of an engagement.
FAQ
Scope Estimator questions
Why does the tool show days and not a price?
Effort is the clearest way to compare proposals. The fee follows from the tester-days and is agreed after a short scoping call, in a fixed-fee proposal.
Why is the result a range?
The same scope can need more or less time depending on how complex the business logic is, how many integrations there are and how ready the environment is. A scoping call narrows the range to a fixed figure.
Is the retest included in the estimate?
The range covers testing, reporting and the walkthrough call. A retest of reported findings is included in every Rudranetra engagement and is planned separately, once you've had time to fix them.
Can we test less to fit a budget?
Yes. A focused test of the highest-risk areas, such as authentication, authorization and payment flows, is better than spreading too few days across everything. We'll suggest a priority order on the scoping call.
Related
Five things to fix before your first pentest
Five quick fixes that help your first penetration test focus on the issues that matter, from security headers to test accounts and secrets in code.
Web Application Penetration Testing
Manual testing of your web app's authentication, access control and business logic, the places scanners can't reach.