Loading…
Home / Pentest scope authorization
Pentest scope authorization, enforced rather than filed
Scope authorization is the record that answers the only question that matters if a test is ever questioned: who permitted this, on which assets, and when. This page explains what a defensible record has to contain, and how PentSeal makes that record the thing that decides whether a scan may run at all.
What scope authorization is
A penetration test is, technically, the same set of actions an attacker performs. What separates the two is authorization: a specific, dated permission from the party who controls the target, covering a defined scope and window. Scope authorization software exists so that permission is a structured record inside the tool that does the testing — not a signed PDF kept in a folder that nobody can tie back to the scans that ran.
The distinction is not academic. In a dispute, an incident review, or a client audit, the question is not whether the test was legitimate in principle. It is whether you can show, from the system of record, that this scan against this asset fell inside this authorization. A record assembled after the fact cannot answer that; a record the tool enforced as a precondition can.
What a scope authorization record must contain
Proof of ownership
Who controls the target, evidenced rather than asserted — a DNS TXT or HTTP challenge answered from the asset itself, so the record ties to the thing being tested and not to a name typed into a form.
The scope itself
The exact assets in scope — hostnames, IP ranges, ports, applications — and an equally explicit out-of-scope list. Scope that is only described in prose is scope that will be argued about later.
The testing window
The dates and hours during which testing may run, and any rate or technique restrictions that apply inside it. A window is what stops an authorized test from being an authorized outage.
A named signer
The person who authorized the work, acting on behalf of the asset owner, with their acceptance captured in the record — not a screenshot of an email thread.
An audit trail
When the authorization was created, what changed, and when each scan ran against it, so the sequence can be reconstructed if anyone later questions whether the testing was permitted.
Why authorization should be a gate, not a document
A dashboard that shows a scanning window is not a control; it is a reminder. The control is a scanner that refuses to run outside the ports and hours that were agreed, and an ownership challenge that has to be answered from the target itself before any scan is permitted. That is the difference between documenting a limit and enforcing one.
PentSeal verifies target ownership, records the signed scope and testing window as a single record, and gates execution on it: no valid authorization, no scan. Findings come back with CVSS, CWE and evidence, mapped to the SOC 2 and PCI DSS controls they touch, and export as one deliverable. The authorization record and the evidence trail are the same object, so the story the report tells and the permission that allowed it cannot drift apart.
If you have not signed up yet, the free scope generator will produce the document in the browser — nothing is uploaded or stored — and you can pair it with the free authorization letter and rules of engagement templates. Those give you the paperwork. PentSeal is what makes the paperwork binding on execution.
What it costs
PentSeal is priced per account, not per scan: Starter is $79/month for one user with up to five engagements per billing month, and Professional is $249/month for up to five users with unlimited engagements. Enterprise is priced per deployment. The pricing page lists the plan limits from the same definitions the product enforces. The templates and the scope generator above are free and require no account.
Scope authorization FAQ
- What is pentest scope authorization?
- Pentest scope authorization is the record that says who authorized the testing, exactly which assets and time window are covered, and on what conditions. It is the artefact that separates an authorized penetration test from unauthorized access — the permission, in writing, that a report and an audit trail can both point back to.
- How is scope authorization different from a rules of engagement document?
- The scope authorization records whether testing is permitted and against what — the permission. The rules of engagement records how the permitted testing will be conducted, communicated, escalated and stopped — the plan. Most engagements need both, cross-referenced by date so it is always clear which scope a given test ran under.
- Why does scope authorization software matter for a penetration test?
- Because a scanned host does not distinguish between an authorized tester and an attacker; only the paperwork does. Software that holds the authorization as a gate makes the permission the thing that lets a scan run at all, so the trail is produced by doing the work rather than assembled afterwards. If a scope or window is later disputed, the record already exists in the system that ran the test.
- What should a scope authorization record contain?
- At minimum: proof of ownership of the target, the in-scope and out-of-scope assets, the testing window and any technique restrictions, the named signer and their acceptance, and a tamper-evident audit trail of what ran and when. Anything less leaves the permission to be reconstructed from memory and email.
- Can I generate a scope authorization without signing up?
- Yes. The free scope generator builds a scope and authorization document in the browser — nothing is uploaded or stored — and the authorization letter and rules-of-engagement templates are free to download and adapt. PentSeal is what enforces the same record as a hard gate on execution, which is the part a document cannot do on its own.
Walk the authorization gate yourself
The interactive demo runs the ownership challenge, signed scope and scan gate on sample data — no account and no scan required.