A penetration test is a time-boxed exercise. Every hour spent re-confirming a known misconfiguration is an hour not spent chaining a subtle authorisation flaw into a real breach path. Scoping decides which of those two engagements you buy.
Start from the consequences, not the asset list
Asset lists tell a tester what exists. They do not say what would end your quarter. Before counting endpoints, write down the three outcomes that would genuinely hurt: customer data exposure, fraudulent transactions, loss of production availability.
Those outcomes become the objectives testers work backwards from, and they make the final report readable by people who do not know what SSRF means.
Give testers credentials — all of them
Unauthenticated testing tells you what an anonymous internet user can do. That is a small share of real risk for most SaaS and internal applications.
Provide one account per role, ideally in duplicate so cross-account and cross-tenant checks are possible without guessing identifiers.
- Two accounts per privilege level, in separate tenants where applicable
- Any second-factor bypass procedure for test accounts
- A safe way to reset test data mid-engagement
Be explicit about what must not break
Prohibited actions belong in the rules of engagement, not in a hallway conversation. Denial of service, destructive payloads, social engineering and testing windows should all be written down and signed.
Clear constraints make testers more aggressive inside the boundary, because nobody is guessing where the boundary is.
Budget for the retest before you start
A finding is not closed until someone independently confirms it. Retesting is cheap relative to the original engagement and it is the only part of the process that produces evidence of improvement.
Key takeaway
Scope around consequences, hand over real credentials, write the constraints down, and reserve budget for the retest. Everything else is detail.