Pentest Inc. logo
Pentest Inc.
Offensive Security Assessments
Home•Methodology
Methodology

Disciplined methodology for credible offensive security outcomes.

Our assessments reference OWASP guidance, NIST-informed practices, MITRE ATT&CK techniques, and compliance expectations such as PCI DSS, HIPAA, SOC 2, ISO 27001, and PIPEDA when relevant to the engagement.

1

Scoping

Define targets, assumptions, constraints, schedule, and rules of engagement.

2

Reconnaissance

Map the attack surface and identify likely paths to valuable exposure.

3

Validation

Use manual testing and controlled exploitation where appropriate to prove risk.

4

Reporting

Translate findings into executive context, technical evidence, and remediation priorities.

5

Retest

Support post-fix validation so teams can confirm closure and reduce lingering doubt.

How we keep testing controlled

  • Authorized testing only with written permission mandatory.
  • Defined testing windows and escalation contacts.
  • Scope control to avoid surprises during active engagements.
  • Evidence collection designed to support remediation and stakeholder alignment.

Rules of engagement

Before testing begins, the engagement must have written authorization, named points of contact, approved targets, and an agreed ROE that covers timing, impact limits, and emergency handling.