Penetration Test Plan

For improving your cybersecurity company’s sales process, you must provide potential clients a clear
understanding of what takes place during penetration testing. The sales team has asked you to
construct an outline of a penetration test plan, detailing what each step will entail so potential clients
can better understand the process, the techniques, and the tools involved. They also want to provide
clients with the kind of information they will receive from the test.
Write a 2- to 3-page outline of the penetration test plan using the following Penetration Testing
Execution Standard steps/categories for your outline:
Pre-engagement Interactions
Intelligence Gathering
Threat Modeling
Vulnerability Analysis
Exploitation
Post Exploitation
Reporting
Explain what each step includes. Include issues and questions you should anticipate from a potential
client.

Penetration Test Plan

To maximize the selling process for our cybersecurity company prospective clients must clearly comprehend the way penetration testing works (RSI Security, 2020). This document provides the penetration test strategy, describing what will occur at each step in accordance with the Penetration Testing Execution Standard (n.d .)

Interactions prior to engagement (Scoping)

In this stage the organization will clearly determine the scope of the test and the estimated time and the cost. To determine the exact scope, the customer should respond to a range of questions, such as the motives behind the test as well as the need for specific tests. The client might also want to know if a specific compliance requirement requires a penetration test, and what actions the testing team takes in the event of a breach.

Intelligence Gathering

Intelligence Gathering would entail performing surveillance of a person in order to collect enough information that allows for the penetration of a target in the vulnerability assessment and exploitation methods. A key technique for intelligence gathering is Open-Source Intelligence (OSINT). OSINT can be used to find different entry points to an institution. These entrance points can be electronic, human or physical. During this time the client might want to know about the test’s duration and goals or goals.