> ## Content Index > Fetch the complete content index at: https://plaintext.block8.ai/llms.txt > Use this file to discover other available public pages before exploring further. # Questions to Ask Before You Book a Penetration Test - URL: https://plaintext.block8.ai/blog/questions-to-ask-before-you-book-a-penetration-test/ - Published: 2026-09-23T08:00:02.000Z - Updated: 2026-09-23T08:00:02.000Z - Author: Aiselade Dionisio - Tags: AI-Powered Penetration Testing, Buying Guides ### **The buyer's situation** Before booking a penetration test, you need more than a price and a date. A useful test starts with clear scope, clear expectations and a shared understanding of what the business actually needs from the engagement. Get this wrong and you can end up with a report that's technically accurate but commercially unhelpful, the difference between a good and a disappointing engagement often only becomes obvious after the report lands. ### **Questions about scope** What systems, applications or environments are included, and what's explicitly excluded? Are APIs and authenticated user journeys in scope? Are third-party systems involved, and if so, whose responsibility are they? What access does the tester need, what testing window is required, and could testing disrupt live systems? Scope is where most misunderstandings begin — a vague scope leads to missed coverage, unexpected exclusions or delays. ### **Questions about methodology and reporting** Is testing automated, manual or both, and are findings manually validated before they reach the report? How is exploitability assessed, and how are false positives managed? Who performs the test, and what credentials or experience does the team hold? On reporting: can we see a sample report? Does it explain business impact and include remediation guidance, with findings prioritised rather than just listed? Is the language understandable for non-technical stakeholders as well as IT? ### **Questions about what happens after** Finding the issue is not the finish line. Will we be notified immediately if something critical is found mid-engagement, or only in the final report? Is a debrief included? Can we ask follow-up questions after the report is delivered? Is retesting included as standard, or a separate request, and how is it triggered once remediation is complete? What should our team do first? ### **Where Block8.ai fits** These are the same questions we expect to be asked, and we'd rather you ask them before booking than discover the answers after the report arrives. Scope and the testing approach are set out clearly in every Letter of Engagement before work begins, and our model combines AI-powered exploitation with human-validated reporting, meaning faster, broader testing without losing the judgement that makes findings worth acting on. Engagement starts through a digital self-serve portal, available 24/7, with no lengthy procurement process before testing can start. Re-testing is included as standard, run as required once remediation is complete, and every report includes, as a minimum, an executive summary for non-technical management, details of key findings, and detailed remediation advice. ## FAQ Should I ask for a sample report before booking? Yes — it's one of the most reliable ways to assess reporting quality and depth before committing. What's the most commonly overlooked scoping question? Whether critical findings are communicated immediately during the engagement, or only in the final report — the difference matters if something serious is found early. Do I need internal IT involved in scoping? Usually, yes — IT teams help confirm scope, access, timing and who will own remediation once findings come in. Should post-test support be agreed before the engagement starts? Yes — confirming what's included, such as prioritisation guidance, before the engagement begins avoids ambiguity once the report is delivered. Ask specifically whether retesting is included as standard. What should a report include as a baseline? At minimum, an executive summary suitable for non-technical management, details of key findings, and detailed remediation advice — confirm any provider's report meets this baseline before booking. ## What to do next Got your answers ready? Get started with a self-serve Letter of Engagement. [Get your Letter of Engagement](https://www.block8.ai/engagement-plans?ref=plaintext.block8.ai) Want to ask us these questions directly first? [Contact Block8.ai](https://www.block8.ai/contact?ref=plaintext.block8.ai) ![Bob Ledger](https://plaintext.block8.ai/assets/images/authors/bob-ledger.jpg) CEO & Co-founder ### Bob Ledger [Read Bob's bio →](https://plaintext.block8.ai/team/#bob-ledger)