--- title: "White Paper: How to Define the Scope of a Pentest?" description: This white paper gives you the keys to define the security priorities and the pentest strategy suited to the challenges of your industry and your systems --- [![logo vaadata](https://resources.vaadata.com/hs-fs/hubfs/logo_dark_RVB.png?width=147&height=58&name=logo_dark_RVB.png "logo vaadata")](https://www.vaadata.com/en/) Open main menu Close main menu - RESOURCES Open the submenu - [BLOG](https://www.vaadata.com/en/blog/) - [EBOOKS & WHITE PAPERS](https://www.vaadata.com/en/ebooks-white-papers/) - SERVICES Open the submenu - [PENETRATION TESTING](https://www.vaadata.com/en/penetration-testing-services/) - [RED TEAMING](https://www.vaadata.com/en/red-teaming/) - [ASSUMED BREACH](https://www.vaadata.com/en/assumed-breach/) - [VAADATA](https://www.vaadata.com/en/about-vaadata/) - [CONTACT](https://www.vaadata.com/en/contact/) # WHITE PAPER: How To Define The Scope of A Pentest? Defining the scope of a pentest is a delicate step. What will be the target of the pentest? Which functional and technical aspects should be tested first? What depth and frequency of testing is recommended? The objective of this white paper is to provide you with various information to help you define a pentest strategy that suits the challenges of your industry, your organisation and your systems and applications.  We have gathered all key elements from our discussions with around 500 client companies of all sizes and from all sectors of activity. Each element has to be analysed according to your business context. You will then be able to determine a scope for your future security audits. Making choices upstream will allow you to be more effective during your exchanges with the partner in charge of the pentest. However, discussion remains essential, as it is by confronting your internal viewpoint with the external viewpoint of a specialised third party that you will reach the best choices in order to validate your security audit project. ![visual](https://resources.vaadata.com/hubfs/Design%20sans%20titre%20(3)-1.svg "visual") Identify which assets and risks to prioritise to determine what genuinely needs to be tested, based on asset criticality, the data being processed, exposure levels and the risks specific to your organisation. Choose the right scope and testing approach by selecting the relevant technical environments and deciding how much information to provide to the pentesters : black-box, grey-box or white-box testing. Scope your penetration test effectively by assessing the factors that influence its duration, coverage and depth, so the engagement can be tailored to your objectives and constraints. Build a long-term penetration testing strategy by adapting the scope of your assessments as your IT environment, risks and security practices evolve, including the use of AI to enhance pentesters’ capabilities. #### SERVICES - [Web Application Pentest](https://www.vaadata.com/en/penetration-testing-services/web-app-penetration-testing/) - [Mobile Application Pentest](https://www.vaadata.com/en/penetration-testing-services/mobile-app-penetration-testing/) - [Infrastructure & Network Pentest](https://www.vaadata.com/en/penetration-testing-services/infrastructure-and-network-penetration-testing/) - [IoT Pentest](https://www.vaadata.com/en/penetration-testing-services/iot-penetration-testing/) - [Cloud Pentest](https://www.vaadata.com/en/penetration-testing-services/cloud-penetration-testing/) - [Social Engineering Pentest](https://www.vaadata.com/en/penetration-testing-services/social-engineering-penetration-testing/) - [Red Teaming](https://www.vaadata.com/en/red-teaming/) - [Assumed Breach](https://www.vaadata.com/en/assumed-breach/) #### RESOURCES - [\[White Paper\] Identify data leaks on the dark web](https://resources.vaadata.com/en/white-paper-how-to-prevent-attacks-and-identify-data-leaks-on-the-dark-web) - [\[White Paper\] Social Engineering Pentest](https://resources.vaadata.com/en/white-paper-social-engineering-pentest-how-to-create-a-campaign) - [\[White Paper\] IoT Security](https://resources.vaadata.com/en/security-of-iot-wireless-technologies) - [\[White Paper\] Define the scope of a pentest](https://resources.vaadata.com/en/white-paper-how-to-define-the-scope-of-a-pentest) - [\[Business Case\] Software Publisher](https://resources.vaadata.com/en/business-case-pentest-software-publisher) - [\[Business Case\] FinTech Company](https://resources.vaadata.com/en/business-case-pentest-fintech-company) - [\[Business Case\] E-commerce Division](https://resources.vaadata.com/en/business-case-pentest-ecommerce-division-retail-group) - [\[Business Case\] IT Consulting Group](https://resources.vaadata.com/en/business-case-pentest-it-consulting-group) #### CONTACT - VAADATA - 33 Quai Arloing, 69009 LYON - France - +33 (0)4 37 92 98 85 - contact@vaadata.com ![logo_dark_RVB](https://resources.vaadata.com/hs-fs/hubfs/logo_dark_RVB.png?width=200&height=78&name=logo_dark_RVB.png "logo_dark_RVB") [Follow us on LinkedIn](https://www.linkedin.com/company/vaadata/)