Answers
Straight answers, before you buy anything.
These are the questions that come up in scoping calls. Each page answers one of them directly, including the ones where the honest answer is that a framework does not require what a vendor says it requires.
What is penetration testing?
A penetration test is an authorized attempt to break into a system you own, to find what an attacker could reach before one tries. How it works, end to end.
Vulnerability assessment vs penetration testing
One measures breadth, the other measures depth. Which you need depends on whether you already know you have a backlog.
What is a vulnerability assessment?
A vulnerability assessment is a structured search for weaknesses across a defined scope, with each finding confirmed and ranked by severity.
Does SOC 2 require a penetration test?
No. SOC 2 states control objectives, not procedures. But your auditor will usually ask for a test, and here is why.
How often should you run a penetration test?
Annual is the common floor and the wrong answer on its own. The trigger that matters is significant change, which is why shipping teams test more often.
What is in a penetration test report?
What a penetration test report should contain, how to tell a real report from a rebranded scanner export, and what to do with it first.
What is prompt injection?
Prompt injection is text a model reads as data being treated as an instruction. The dangerous form is indirect, and the damage is set by tool permissions.
MCP server security: what to check
An MCP server is a set of tools with real credentials behind it. What to check before you connect one to an agent, and what to review after.
Black box vs white box penetration testing
Black box testing mimics an outsider's starting position. White box testing finds more in the same time. Which to choose, and why most tests should be grey.
What are rules of engagement in penetration testing?
The rules of engagement name the targets, the window, the permitted techniques and the contacts. It is what makes authorized testing legal and fast.
What drives the cost of a penetration test?
Penetration testing is priced per scope. Here are the variables that move the number, so you can read a quote and compare two of them honestly.
Next step
Start with a scoping call.
Tell us what you need tested. Before any testing begins, the scope is written down and the agreement and rules of engagement are signed.