Title: Penetration testing > Commission a clearly bounded security test, with written authorisation, useful findings and an agreed remediation-verification scope. Source: https://aegentra.co.uk/services/harden/penetration-testing Publisher: Aegentra (aegentra.co.uk), United Kingdom edition. Prices in GBP excluding VAT. Published: 2026-10-21 Updated: 2026-10-21 Licence: public web content; cite the source URL. Security hardening / United Kingdom # Penetration testing Commission a clearly bounded security test, with written authorisation, useful findings and an agreed remediation-verification scope. Last reviewed 21 October 2026. Fees in pounds sterling plus VAT. [Discuss your scope](https://aegentra.co.uk/contact?subject=Penetration%20testing) [See a working example](https://aegentra.co.uk/services/harden/penetration-testing#working-example) What are we authorised to test—and when must we stop? Scope and fee ## Agree the work. Know the boundary. The written proposal defines the scope, responsibilities, price and delivery timetable. ### What shapes your quote - Scope, complexity and existing evidence - Required specialist work and access arrangements - Depth of reporting and any separately agreed follow-up [Request a scoped proposal](https://aegentra.co.uk/contact?subject=Penetration%20testing) The requirement in context ## Define the requirement before selecting the work. Define the targets, business risk, permitted techniques and escalation contacts before testing. A vulnerability scan, a penetration test and a Microsoft 365 configuration assessment are different engagements. Primary references [NCSC: commissioning penetration testing](https://www.ncsc.gov.uk/guidance/penetration-testing) Inside the work ## What are we authorised to test—and when must we stop? Original fictional working example. The actual criteria, evidence, scope and delivery arrangements are agreed for your organisation. | Work area | Decision to make | Evidence to retain | | --- | --- | --- | | Authority | Confirm ownership and permission for every target. | Signed scope and relevant third-party permission. | | Safety | Agree testing window, exclusions and stop conditions. | Rules of engagement and escalation contact. | | Findings | Connect observed evidence to impact and a practical fix. | Report, limitations, owner and retest agreement. | Fictional example · Not a client result, legal determination or complete audit checklist. [Download this working example (CSV)](https://aegentra.co.uk/downloads/harden-penetration-testing-working-example.csv) What you take away ## Evidence. Ownership. A practical next step. Commission a clearly bounded security test, with written authorisation, useful findings and an agreed remediation-verification scope. - Asset scope, ownership and written authorisation - Rules of engagement, timing and stop conditions - Agreed testing and evidence-led findings - Prioritised report and separately defined retest ### Separate responsibilities No test begins without authority for the targets. Social engineering, denial-of-service testing, third-party infrastructure, remediation and retesting are not included unless explicitly agreed. How the work moves forward ## Assess first. Change with control. Responsibilities and access are agreed before the engagement. Work stays connected to the outcome—not the number of documents produced. - ### Confirm the boundary Agree systems, permissions, dependencies and exclusions. - ### Assess the evidence Record observed settings and prioritise the agreed risks. - ### Control the change Approve remediation, test the result and keep a handover record. A practical starting point ## What are we authorised to test—and when must we stop? Define the targets, business risk, permitted techniques and escalation contacts before testing. A vulnerability scan, a penetration test and a Microsoft 365 configuration assessment are different engagements. Fictional working exampleAuthority — Confirm ownership and permission for every target. — Signed scope and relevant third-party permission. Safety — Agree testing window, exclusions and stop conditions. — Rules of engagement and escalation contact. Findings — Connect observed evidence to impact and a practical fix. — Report, limitations, owner and retest agreement. Before you commission the work ## Your questions. Clear answers. **What are we authorised to test—and when must we stop?** Define the targets, business risk, permitted techniques and escalation contacts before testing. A vulnerability scan, a penetration test and a Microsoft 365 configuration assessment are different engagements. **What is included in the engagement?** Asset scope, ownership and written authorisation; Rules of engagement, timing and stop conditions; Agreed testing and evidence-led findings; Prioritised report and separately defined retest. The proposal defines the exact outputs and acceptance criteria. **What is not automatically included?** No test begins without authority for the targets. Social engineering, denial-of-service testing, third-party infrastructure, remediation and retesting are not included unless explicitly agreed. **What does the service cost?** UK service fees are quoted for the agreed scope. We confirm a quote after reviewing the agreed boundary, starting position, dependencies and required deliverables. **How should we share evidence?** Agree secure access, minimisation and retention before work starts. Describe the requirement in the enquiry; do not send passwords or sensitive records through the form. **What should a penetration-test scope specify?** Identify authorised targets, objectives, exclusions, test accounts, allowed techniques, timing, third-party permissions and escalation contacts. Agree evidence handling, reporting and retest boundaries. Testing must not begin without appropriate written authorisation. **Do you claim CHECK or CREST accreditation?** We do not make a blanket CHECK or CREST accreditation claim. If your procurement requires a specific scheme or accreditation, make it an explicit requirement and verify the appointed provider’s current scope before engagement. General penetration testing and a scheme-specific assessment are not interchangeable. **What should we prepare for a scoping conversation?** Describe the organisation, product or service, customer requirement, systems and preferred timing. Do not send passwords or confidential records through the enquiry form. We agree secure evidence handling separately. ## Resources for this decision. [NCSC: CHECK introduction](https://www.ncsc.gov.uk/schemes/check/introduction) Choose the right route ## Connected work. Distinct responsibilities. Commission organisational support, build your own knowledge or clarify what a customer has requested. ### Related services [Microsoft 365 security assessment](https://aegentra.co.uk/services/harden/microsoft-365-security-assessment) [ISO 27001 implementation](https://aegentra.co.uk/services/govern/iso-27001) ### Clarify your requirement [Read the decision guide](https://aegentra.co.uk/knowledge/course-or-consultancy) ## Let’s define the work you actually need. Tell us what you need to achieve, what is in scope and where you are starting. [Talk about your project](https://aegentra.co.uk/contact)