A penetration test scope should start from what an attacker would want from you, cover the systems and paths that lead to it, and exclude anything only as a written decision. The scope, agreed weeks before testing starts, decides how much assurance the test gives, far more than the tester's skill does.
Two organisations can both say "we get an annual pentest" and be describing completely different levels of assurance. A real attacker ignores your scope. They go where the value is and in through whatever is weakest. A useful penetration test approximates that behaviour as closely as your risk appetite and budget allow, and the scoping conversation is where that approximation is set.
The default scope is a list of systems: this web application, that IP range. The better starting question is what an attacker would want from you. Customer records, payment flows, intellectual property, the ability to move money, the ability to disrupt operations. Then work backwards: which systems touch those assets, and which paths lead to them?
Worked this way, the scope usually changes shape. The marketing site drops out; the forgotten API that fronts the customer database drops in. The identity provider that gates everything matters more than the corporate network. This is also how the test stays affordable, because money is spent where compromise would hurt.
Scoping conversations have a predictable pattern: the systems everyone is confident about go in, and the awkward ones get excluded. The legacy application nobody wants to touch, the third-party integration, the subsidiary's environment, the thing that might fall over if tested. Each of those exclusions marks a likely starting point for an attacker.
There are legitimate exclusions, fragile production systems chief among them, and there are good ways to handle them: test a staging replica, agree careful timing windows, or accept the untested risk in writing so it is a recorded decision. What should not happen is the quiet narrowing that leaves the test covering only the defensible ground.
An external test answers one question: can someone get in from the internet? Increasingly, the more valuable question is what happens once someone is in, because phishing, stolen credentials and supply chain compromises mean the perimeter fails somewhere eventually. An assumed-breach scope starts the tester with a standard user's access and tests the controls that decide whether an incident is contained or catastrophic: segmentation, privilege escalation paths, detection and response.
If the budget covers one test a year, alternating between the two across years covers more ground than repeating the same external test until it stops finding things.
Ask to see a sample report before engaging anyone. It should read as two documents in one: risk in business terms for the people who own the budget, and reproduction steps with remediation guidance for the engineers who fix the findings. If it reads like a scanner export with a logo, that is what you would be buying.
Then insist on retesting. A finding that is reported but never verified as fixed may still be open. We include retesting in every engagement at no separate charge, because a test that ends at the report has done half the job.
The assets an attacker would want, the systems and paths that lead to them, the type of test (external or assumed breach), agreed timing windows, and any exclusions recorded as written decisions.
Most engagements cost $8,000 to $35,000, with red team work starting around $60,000. Scope is the biggest factor. Our guide to how much a penetration test costs in Australia breaks this down by test type.
Only with a plan. Test a staging replica, agree careful timing windows, or accept the untested risk in writing so the exclusion is a decision someone owns.
A test that starts the tester with a standard user's access, to see how far an attacker could get after a phishing email or stolen password. It tests segmentation, privilege escalation paths, and detection and response.
Not with every provider. Ask before you sign. Coder Trove includes retesting of remediated findings in every engagement.
Our cyber security practice scopes penetration tests against what organisations hold. The scoping conversation itself costs nothing and usually changes the test. If you are also preparing for an incident, see how to rehearse an incident response plan.
Ben Jones leads the cyber security practice at Coder Trove.