Scoping a Penetration Test and Rules of Engagement

IntermediateFree5 modules · 15 lessons

About this course

A practical course on commissioning a penetration test correctly: defining a precise scope, obtaining a signed authorization letter rather than a verbal assurance, choosing between black box, gray box, and white box information levels, building safety controls into the engagement, selecting and vetting a testing provider, setting expectations for the deliverable, and closing the loop with retesting. You will work through hypothetical scoping disputes and see exactly which scoping decision would have prevented each one.

What you'll learn

Why Scope Comes Before Testing

The Penetration Test as a Commissioned Engagement
The Cost of an Unscoped Test
Defining Scope With Precision
The Authorization Letter: Why Verbal Assurance Is Not Enough
Black Box, Gray Box, and White Box: Trade-offs, Not a Ladder

Safety Controls and Provider Selection

Building Safety Controls Into the Engagement
Techniques That Could Cause an Outage, and Why Skill Is Not a Safety Control
Selecting and Vetting a Testing Provider

Vetting in Practice and the Deliverable

A Hypothetical Vetting Scorecard
What a Good Penetration Test Report Actually Contains
The Raw Tool Output Trap

01Why Scope Comes Before Testing5 lessons

The Penetration Test as a Commissioned Engagement
The Cost of an Unscoped Test
Defining Scope With Precision

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Remediation and Retesting

From Findings to Fixes: Prioritizing Remediation by Business Context
Retesting to Verify Remediation: The Step Organisations Skip

Running a Programme Over Time

Building a Repeatable Cadence and Evolving Scope as the Organisation Changes
Course Synthesis: A Scoping and Rules of Engagement Checklist

The Authorization Letter: Why Verbal Assurance Is Not Enough

Black Box, Gray Box, and White Box: Trade-offs, Not a Ladder

02Safety Controls and Provider Selection3 lessons

Building Safety Controls Into the Engagement
Techniques That Could Cause an Outage, and Why Skill Is Not a Safety Control
Selecting and Vetting a Testing Provider

03Vetting in Practice and the Deliverable3 lessons

A Hypothetical Vetting Scorecard
What a Good Penetration Test Report Actually Contains
The Raw Tool Output Trap

04Remediation and Retesting2 lessons

From Findings to Fixes: Prioritizing Remediation by Business Context
Retesting to Verify Remediation: The Step Organisations Skip

05Running a Programme Over Time2 lessons

Building a Repeatable Cadence and Evolving Scope as the Organisation Changes
Course Synthesis: A Scoping and Rules of Engagement Checklist

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.